2

I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted.

I tried all possible tools that I found online, when that failed I tried to do so manually using some tutorials I found online, I always end up destroying the executable in the first stage of the unpacking. I'm using dnspy for this sample. each time I attempt to locate the anti-tamper module, it ends up being the incorrect one and i end up destroying the executable..

Then I tried to debug it and check for memory dumps on x64(32 bit) debugger, I found some anti debugging mechanisms but I am still missing something because the program just keeps running junk code until i detach from it and it crashes, dumping it when its already loaded into memory also dumps junk code.

What am I missing here? Does anyone have experience with unpacking the confuserex packer? Can you guys link me to some information I'm missing? or maybe explain how the ConfuserEx works?

I would appreciate help in understanding how to unpack it. I'll provide the sample here:

[WARNING THIS IS A LIVE MALWARE SAMPLE]
eagleepicsocks(dot)com/jk/jkeq.exe
[WARNING THIS IS A LIVE MALWARE SAMPLE]
  • What exactly do you mean by "destroying"? – John Doe Dec 27 '17 at 10:20
  • I'm assuming the memory gets corrupted there is no way of knowing since the file is so highly obfuscated I have a hard time knowing what exactly got destroyed. I am new to the field so even if there is a way of knowing I dont hold the skill set for it – Potato Dec 27 '17 at 10:36
  • Tip: ConfuserEx will unpack the target during runtime and keep it in memory. You can dump it using dnSpy Debugging. I think the name of the unpacked module was koi or something like that. – Michael Pittino Mar 31 '18 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.