The oldest sample related to the new version of dotRunpeX is dated. This new threat is used to deliver numerous different malware families, primarily related to stealers, RATs, loaders, and downloaders. We uncovered several different methods of distribution where in all cases, the dotRunpeX was a part of the second-stage infection. The monitoring showed that this new dotnet injector is still evolving and in high development.

CPR introduces several PoC techniques that were approved to be effective for reverse engineering protected or virtualized dotnet codeĭuring the past few months, we have been monitoring the dotRunpeX malware, its usage in the wild, and infection vectors related to dozens of campaigns.

We confirmed and detailed the malicious use of a vulnerable process explorer driver to disable the functionality of Anti-Malware services.

Commonly distributed via phishing emails as malicious attachments and websites masquerading as regular program utilities.

Investigation shows that dotRunpeX is used in the wild to deliver numerous known malware families.

DotRunpeX is protected by virtualization (a customized version of KoiVM) and obfuscation (ConfuserEx) – both were defeated.Check Point Research (CPR) provides an in-depth analysis of the dotRunpeX injector and its relation to the older version.

Old version anydesk