Skip to content

Instantly share code, notes, and snippets.

@0xToxin
Created February 10, 2023 22:51
Show Gist options
  • Save 0xToxin/a70c56e4d9ff9de6b057f13abd84f83f to your computer and use it in GitHub Desktop.
Save 0xToxin/a70c56e4d9ff9de6b057f13abd84f83f to your computer and use it in GitHub Desktop.
Simple ASyncRAT config extractor using dynamic invocation
#Sample => https://bazaar.abuse.ch/sample/00cdee79a9afc1bf239675ba0dc1850da9e4bf9a994bb61d0ec22c9fdd3aa36f/
$reflectedAsm = [System.Reflection.Assembly]::LoadFile("C:\AsyncRAT.bin")
$SettingsType = $reflectedAsm.GetType("Client.Settings")
($SettingsType.GetMethod("InitializeSettings")).Invoke($null, $null)
$fields = $SettingsType.GetFields()
foreach ($field in $fields){
$value = $field.GetValue($null)
Write-Host "$($field.Name): $value"
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment