[miso]

i coudn't find the original thread of the application, however, i've downloaded it to manually scan it

this application sends your hardware configuration to an ip (47.254.216.24:8989), checks if it is running in a VM & setups a rat on user login

Less important screenshots:

Spoiler:

Code proof:

Spoiler:

Getting Hardware Info:


Checks if it is running in a VM:

Code:

U3lzdGVtXEN1cnJlbnRDb250cm9sU2V0XFNlcnZpY2VzXERpc2tcRW51bVw= | System\CurrentControlSet\Services\Disk\Enum\
Y21kLmV4ZSAvYyBwaW5nIDAgLW4gMiAmIGRlbCA= | cmd.exe /c ping 0 -n 2 & del

Setups RAT on login:


TcpConnection:

i still have the original sample, dm me if you want it (i will not share it on sinister.ly publically, don't want to get banned)

here is some tools i've made to decrypt some things, like the resources & strings

Virustotal Scan [2/72] (ResourceDecrypt.exe)
Virustotal Scan [2/72] (StringDecrypt.exe)

Download (ResourceDecrypt.exe)
Download (StringDecrypt.exe)

@mothered

[mothered]

Excellent analysis Indeed.

Evidently, the file Is Infected with malicious Intent. Is this the thread It relates to?

[miso]

Excellent analysis Indeed.

Evidently, the file Is Infected with malicious Intent. Is this the thread It relates to?

yes indeed,thanks for finding the thread back

[mothered]

Excellent analysis Indeed.

Evidently, the file Is Infected with malicious Intent. Is this the thread It relates to?

yes indeed,thanks for finding the thread back

Just wanted to make sure prior to taking action.

I've removed It from the said thread, and action has been taken accordingly against the OP.
Once again, good work with your analytical reports.