[Cyber_]

Hi,

I would like to ask for my help. I can't unpack this malware. My result is only crash. (OEP: 0047FDB0)

Packer: Autoit Cryptor + UPX

Someone can help me?

Thanks!

pass: infected*
http://rghost.net/private/44963997/cb94 ... 68de56e0f1

[EP_X0FF]

IRC bot

[SomeUnusedName]

What was the exact problem with unpacking the given binary?

It works as usual, catch the RunPE stuff (AutoIt used to create suspended process followed by ZwResumeThread), then follow into the new process, where it's simply UPX.

You obviously know both, so what went wrong?