[fathibn514]

DOWNLOAD LINK/
Removed- Staff.



CHECKING BY VIRUS TOTAL: virustotal.com/gui/file/82250183f6c4318d818da7266e142c90763b93e9a3ea0aa4ddfd7595bc8c14dc/detection

[Einsatzgruppe]

Time To Break this Stuff DOwn

[miso]

@mothered , Unsure

View Hybrid-Analysis

Failed to unpack (Tried NoFuserEX, de4dot, de4dot-cex)
High VT Detection but likely is caused by Obfuscator/Packer (ConfuserEX 0.6.0)

[mothered]

@mothered , Unsure

View Hybrid-Analysis

Failed to unpack (Tried NoFuserEX, de4dot, de4dot-cex)
High VT Detection but likely is caused by Obfuscator/Packer (ConfuserEX 0.6.0)

The online virus scan report doesn't seem to Indicate anything conclusive.

There's certainly detections, but their Risk Assessment Is based on possibilities.

[Einsatzgruppe]

@mothered or @miso

i was able to remover Anti Temper and was able to decompress it !

But im lost at what to do now im extremly new one breaking stuff down ! i dont want to make false Claims if i uploaded what i got could either of you figure out the rest for me please ?

To Prove Or Disprove about it being infected or not ...although i know it has a rat packed in .. so if either one of you can help please let me know Thank you very much

[mothered]

@mothered    or      @miso

i was able to remover Anti Temper and was able to decompress it !

But im lost at what to do now im extremly new one breaking stuff down ! i dont want to make false Claims if i uploaded what i got could either of you figure out the rest for me please ?

To Prove Or Disprove about it being infected or not ...although i know it has a rat packed in  .. so if either one of you can help please let me know Thank you very much

Thanks for your help.

I simply don't have the time to delve Into It, so If @miso Is available, It'll be greatly appreciated.

[miso]

@mothered , malicious (application sends email address to IP "2.5.29.17" (host: "aamiens-555-1-9-17.w2-5.abo.wanadoo.fr") in an encrypted form, is also fake)



Other (unsure): Calls to "email.exe"

[mothered]

Excellent work @miso.

For the safety of the community, I've removed the link.