Sekoia Details RePythonNET Automation for .NET Malware Analysis
Summary
Sekoia TDR details a pythonnet/dnlib workflow for decrypting strings in an APT28-modified Covenant Grunt, decompiling .NET malware, and automating analysis through its released RePythonNET-MCP server.
Key points
- Sekoia describes an APT28-modified Covenant Grunt with randomized function names, encrypted strings, and a custom C2Bridge using Koofr or Filen file transfers.
- The workflow fingerprints the string-decryption routine by its IL opcodes, retrieves its key from a static constructor, then patches encrypted strings in the binary.
- The authors combine dnlib and ILSpy through pythonnet to generate decompiled C# for further analysis.
- RePythonNET-MCP exposes tools for .NET binary analysis, decompilation, navigation, and patching through an MCP server.
- The server includes upload and download endpoints for submitting samples and retrieving patched binaries.
- Sekoia presents AI-assisted analysis as a way to automate repetitive work, while noting it is not a silver bullet.
Article Details
- Attack Vectors
- Lure documents delivered via Signal Desktop used VBA macros to trigger execution.
- A user-level COM hijack established persistence by loading a malicious DLL.
- Steganography extracted shellcode from a valid PNG file, which then executed the Covenant GruntHTTPStager.
- APT28's Covenant Grunt used a custom C2Bridge that communicated through file uploads and downloads via Koofr or Filen APIs.
- The Covenant sample used randomized function names and encrypted strings to hinder analysis.
- Defensive Notes
- The article describes fingerprinting the string-decryption routine through IL opcodes, recovering its key from a static constructor, and patching encrypted strings in place using dnlib and pythonnet.
- The article describes combining dnlib with ILSpy through pythonnet to produce decompiled C# for analysis, and exposing analysis, decompilation, and patching functions through RePythonNET-MCP.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 69609e89b04d8d27dc47bda2971376cfd760abb40ffe325f00d0cf3303be8906 | SHA-256 hash of the Covenant sample analyzed in the article. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe Covenant sample used encrypted strings and randomized symbol names to hinder analysis.T1027.003 · SteganographyThe infection chain used steganography to extract shellcode from a valid PNG file.T1071 · Application Layer ProtocolThe Covenant implant used a custom C2Bridge that communicated through file uploads and downloads via Koofr or Filen APIs.T1105 · Ingress Tool TransferThe Covenant Grunt retrieved additional modules and served as a delivery vehicle for specialized modules.T1204.002 · Malicious FileLure documents delivered via Signal Desktop triggered payload execution through VBA macros.T1546.015 · Component Object Model HijackingVBA macros performed a user-level COM hijack to establish persistence by loading a malicious DLL.
Threat Actors
Malware
BeardShell[Malware / Component Names ] referenced implants and modules – Covenant, BeardShell, SlimAgent (and MASEPIE, STEELHOOK, OCEANMAP)MASEPIE[Malware / Component Names ] referenced implants and modules – Covenant, BeardShell, SlimAgent (and MASEPIE, STEELHOOK, OCEANMAP)OCEANMAP[Malware / Component Names ] referenced implants and modules – Covenant, BeardShell, SlimAgent (and MASEPIE, STEELHOOK, OCEANMAP)QuasarRAT[Repository / Project ] tooling and samples – https://github.com/SEKOIA-IO/RePythonNET-MCP, QuasarRAT (open-source .NET RAT)Slimagent[Malware / Component Names ] referenced implants and modules – Covenant, BeardShell, SlimAgent (and MASEPIE, STEELHOOK, OCEANMAP)STEELHOOK[Malware / Component Names ] referenced implants and modules – Covenant, BeardShell, SlimAgent (and MASEPIE, STEELHOOK, OCEANMAP)
Tools
Covenantmethodology and tooling for reversing .NET malware, from manual string decryption of an APT28-modified Covenant Grunt to an automated pipeline using pythonnet, dnlib, and an MCP server to decompile, patch, anddnlibmanual string decryption of an APT28-modified Covenant Grunt to an automated pipeline using pythonnet, dnlib, and an MCP server to decompile, patch, and extract configuration at scale.dnSpyThe manual reversing workflow is time-consuming and tool-friction heavy: decrypting strings, incrementally renaming functions, and iterating on decompiled code is tedious with standard tools like dnSpy.ILSpyThey extended automation to decompilation by combining dnlib with ILSpy’s decompiler via pythonnet (using reflection to instantiate internal types) to produce C# suitable for AI-assisted renaming and reasoning.pythonnetfrom manual string decryption of an APT28-modified Covenant Grunt to an automated pipeline using pythonnet, dnlib, and an MCP server to decompile, patch, and extract configuration at scale.RePythonNET-MCPThe authors release RePythonNET-MCP to support AI-assisted, programmatic decompilation and automated configuration extraction for .NET samples.