2

I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted.

I tried all possible tools that I found online, when that failed I tried to do so manually using some tutorials I found online, I always end up destroying the executable in the first stage of the unpacking. I'm using dnspy for this sample. each time I attempt to locate the anti-tamper module, it ends up being the incorrect one and i end up destroying the executable..

Then I tried to debug it and check for memory dumps on x64(32 bit) debugger, I found some anti debugging mechanisms but I am still missing something because the program just keeps running junk code until i detach from it and it crashes, dumping it when its already loaded into memory also dumps junk code.

What am I missing here? Does anyone have experience with unpacking the confuserex packer? Can you guys link me to some information I'm missing? or maybe explain how the ConfuserEx works?

I would appreciate help in understanding how to unpack it. I'll provide the sample here:

[WARNING THIS IS A LIVE MALWARE SAMPLE]
eagleepicsocks(dot)com/jk/jkeq.exe
[WARNING THIS IS A LIVE MALWARE SAMPLE]
  • What exactly do you mean by "destroying"? – John Doe Dec 27 '17 at 10:20
  • I'm assuming the memory gets corrupted there is no way of knowing since the file is so highly obfuscated I have a hard time knowing what exactly got destroyed. I am new to the field so even if there is a way of knowing I dont hold the skill set for it – Potato Dec 27 '17 at 10:36
  • Tip: ConfuserEx will unpack the target during runtime and keep it in memory. You can dump it using dnSpy Debugging. I think the name of the unpacked module was koi or something like that. – Michael Pittino Mar 31 '18 at 9:12
0

ConfuserEx unpacks your executable at runtime and then gives control to it. After the ConfuserEx loader finishes its job you can dump the memory and the assembly.

In order to avoid detection, you can restort to SysInternals Process Explorer or ProcDump to dump the live process after the loader has finished unpacking. This avoids early interference with the loader and simplifies your dump if no other measures are implemented in the protected program.

You can find an unpacker, this for example, ConfuserEx-Unpacker should do the job. However, the more interesting part is do it by hand: this well-written blog shows how to do that in a real case.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.