ConfuserEx

Reported Context (2)

Both loaders are structurally identical .NET assemblies protected by ConfuserEx, a state-machine-based obfuscator that fragments control flow across hundreds of switch-case branches, making static analysis extremely PureLog Stealer Campaign Uses Copyright Lures and Fileless, Multi-Stage Delivery
in this case, delivered as an XLL file generated with the open-source Excel-DNA framework, protected by ConfuserEx, and titled "Payment Details." XenoRAT Delivered Through Excel XLL With ConfuserEx Obfuscation

Malware (2)

People (3)

MITRE ATT&CK (17)

Vendors (1)

Products (5)

Tools (6)

Industries (4)

Countries (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.