+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Hacking Tools (https://sinister.li/Forum-Hacking-Tools)
+--- Thread: Dark Harvest Combo Editor (/Thread-Dark-Harvest-Combo-Editor)
Pages:
1
2
RE: Dark Harvest Combo Editor - fritz - 05-04-2021
(05-04-2021, 12:12 PM)mothered Wrote:If I was in charge I would just remove the link and provide few lines of code in any language that does the same thing(05-04-2021, 05:52 AM)fritz Wrote: Because those 61MB and the amount of obfuscation I ran an hybrid-analysis to have more details : https://www.hybrid-analysis.com/sample/e64c2c462f204688244413f8419fd79b87f7e4ce2cb3f68cf4cb634ad3cdc366/6090c189bb352b592b428e2dThe following part Is somewhat concerning:
I personally wouldn't use that..
Quote:Possibly tries to implement anti-virtualization techniques
An In depth analysis Is required on the file.
I already spent too much time on this, nobody needs this level of protection and obfuscation for such a ridiculous program, it's literally 10 lines of code come one (I'm talking to whoever the dev is ^^) !
Some elements are definitively suspicious in hybrid-analysis report, although some might also be related to the crash report.. But I'm gonna save my time to analyse actually interesting programs
RE: Dark Harvest Combo Editor - mothered - 05-04-2021
(05-04-2021, 04:47 PM)fritz Wrote: Some elements are definitively suspicious in hybrid-analysis report, although some might also be related to the crash report..Not targeted at yourself, but It's this^ that needs to be Identified and segregated, prior to making a decision on the link's removal.
RE: Dark Harvest Combo Editor - fritz - 05-04-2021
(05-04-2021, 04:57 PM)mothered Wrote:I'm pretty confident mobsync.exe isn't involved in Microsoft crash report, if so then it's definitively malicious (see the part "Installs hooks/patches the running process").(05-04-2021, 04:47 PM)fritz Wrote: Some elements are definitively suspicious in hybrid-analysis report, although some might also be related to the crash report..Not targeted at yourself, but It's this^ that needs to be Identified and segregated, prior to making a decision on the link's removal.
But I can't be sure 100%... No that easy to find full (and readable) details on Windows processes sometimes.
RE: Dark Harvest Combo Editor - mothered - 05-05-2021
(05-04-2021, 05:08 PM)fritz Wrote: I'm pretty confident mobsync.exe isn't involved in Microsoft crash report, if so then it's definitively malicious (see the part "Installs hooks/patches the running process").I see your point and I've checked the report In detail.
I can't risk the probability of Infection, so I've removed the link.