rbot.zip - Controller and bot exe files:
bit.ly/napier_rbot

• Expecting around 12 pages and 4000 words

Recommended Research sites by Napier:

• sciencedirect.com
  
• ieee.com
  
• dl.acm.org (login with napier)
  

sid:1000001 – Snort rule ID. 

Remember all numbers smaller than 1,000,000 are reserved; this is why we are starting with 1,000,001. (You may use any number, as long as it’s greater than 1,000,000.)

rbot.zip - Controller and bot exe files:

bit.ly/napier_rbot

Source Code.zip - Controller and bot source code:

bit.ly/napier_rbot_source

On a Linux machine (can be VSOC Kali or Ubuntu) run:

The strings command prints the sequences of printable characters from a file, which is useful as it gives an idea of the modules used by the code.

Using the command above, we can see that the last line of the output says that the exe file is protected using “Spices.Net Obfuscator”, giving us an idea of what we need to do to make it readable again.

Instructions below are for Windows 10 VM on your local machine:

de4dot is a .NET deobfuscator and unpacker which supports Spices.Net.

Download the exe installer for de4dot from this github repo.

Run the installer

*Be aware this only works in Windows!*

Run the below commands in a command prompt window to deobfuscate the controller and bot exe files in turn.

dnSpy is a debugger and .NET assembly editor which allows us to view the deobfuscated source code.

Download dnSpy from this github repo.

Open the controller-cleaned.exe and bot-cleaned.exe files in dnSpy once installed and open up the folders in the left pane until you reach 'class1.cs', then click on that to view the code!

You can also click 'File -> Export to Project' to convert it into a Visual Studio Solution file (which is what is in the Source Code.zip from the link at the top)