A forum for reverse engineering, OS internals and malware analysis 

Can i request unpacked malwares?

Forum for analysis and discussion about malware.

Can i request unpacked malwares?

 #31704  by FakeAVHunter
 Wed Jun 20, 2018 2:16 pm
Hello everyone today i wanna to ask a question about malware unpack requests.
I Send a question before to peform this action

Re: Can i request unpacked malwares?

 #31711  by EP_X0FF
 Fri Jun 22, 2018 3:33 am
Post your malware you want to unpack in password protected archive. Maybe someone will help you. However if they are protected by commercial software (VMProtect, Themida) etc - nobody want waste their time.

Re: Can i request unpacked malwares?

 #31713  by FakeAVHunter
 Fri Jun 22, 2018 4:39 am
EP_X0FF wrote: ↑Fri Jun 22, 2018 3:33 am Post your malware you want to unpack in password protected archive. Maybe someone will help you. However if they are protected by commercial software (VMProtect, Themida) etc - nobody want waste their time.
The passwords from the archived malwares that needs a unpack / fix / working correctly i had to send three zip files because the first archive was too large to upload so here we go.I Cant unpack malware / i dont taked unpacking virus malware lessons.
Attachments
infected
(6.22 MiB) Downloaded 13 times
infected
(6.58 MiB) Downloaded 11 times
infected
(5.3 MiB) Downloaded 10 times

Re: Can i request unpacked malwares?

 #31717  by EP_X0FF
 Fri Jun 22, 2018 9:32 am
21d20301ed7cefab2acce9afe56dd63db594aeb98c7e596152e2a399835e0c24

Completely deobfuscated in attach. MEMORY.rar
It starts, write self-deletion bat file, executes it and crash itself with fake runtime error dialog. Why it doesn't give you anything else is because it is incredible old and everything related to it is dead.

Bullshit delphi fake av. Everything from it can be grabbed from resources (wav files, gifs, forms etc).

46e9fa0b613f821a9993d2d1d776af87357015cfadbcab59cf42a0730729f2af
is the same as first.

Deobfuscated in attach. MEMORY2.rar
Crypted and packed with UPX 3.07.

Honestly nobody interested in digging into Delphi trash fakeav's that is 4-5 years old. Waste of time.
Attachments
pass malware
(2.85 MiB) Downloaded 16 times
pass malware
(2.05 MiB) Downloaded 10 times

Re: Can i request unpacked malwares?

 #31718  by FakeAVHunter
 Fri Jun 22, 2018 11:44 am
EP_X0FF wrote: ↑Fri Jun 22, 2018 9:32 am 21d20301ed7cefab2acce9afe56dd63db594aeb98c7e596152e2a399835e0c24

Completely deobfuscated in attach. MEMORY.rar
It starts, write self-deletion bat file, executes it and crash itself with fake runtime error dialog. Why it doesn't give you anything else is because it is incredible old and everything related to it is dead.

Bullshit delphi fake av. Everything from it can be grabbed from resources (wav files, gifs, forms etc).

46e9fa0b613f821a9993d2d1d776af87357015cfadbcab59cf42a0730729f2af
is the same as first.

Deobfuscated in attach. MEMORY2.rar
Crypted and packed with UPX 3.07.

Honestly nobody interested in digging into Delphi trash fakeav's that is 4-5 years old. Waste of time.
but thanks for unpack...
 Return to “Malware”