To clean the file we have to rename a .DLL to .EXE and modify some sus IL Code.
Removed the Original .exe that is just a virus
Note I cleaned the File, You Can analyze the file for yourself in DnSpy
Still Run everything in a Controlled Environment. My version is the Fully Cleaned Version.
Even has the Decryptor in the same Folder
Person Spreading Malware:
Original Report:
===================================================================
DOWNLOAD
===================================================================
Password: Chaos46366
Upload.ee
Anonfile
Zippyshare
Mirror Ace
===================================================================
SCREENSHOTS
===================================================================
Original Analysis:
(Still always run EVERYTHING in Sandbox / Virtual Machine)
Stub SRC:
VT:
HB:
Edited by ObbedCode, 28 November 2022 - 06:09 AM.