1

I'm trying to unpack malware packed with ConfuserEx 1.0.0 and I can't seem to get it to work. Each time I remove the anti-tamper the whole file gets corrupted.

I tried all possible tools that I found online, when that failed I tried to do so manually using some tutorials I found online, I always end up destroying the executable in the first stage of the unpacking. I'm using dnspy for this sample. each time I attempt to locate the anti-tamper module, it ends up being the incorrect one and i end up destroying the executable..

What am I missing here? Does anyone have experience with unpacking the confuserex packer? Can you guys link me to some information I'm missing? or maybe explain how the ConfuserEx works?

I would appreciate help in understanding how to unpack it. I'll provide the sample here:

[WARNING THIS IS A LIVE MALWARE SAMPLE]
eagleepicsocks.com/jk/jkeq.exe
[WARNING THIS IS A LIVE MALWARE SAMPLE]

closed as off-topic by Steffen Ullrich, schroeder Dec 27 '17 at 9:15

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder
If this question can be reworded to fit the rules in the help center, please edit the question.

  • @forest please do not encourage cross-posting. Flag for migration, if necessary. As I agree this might get better answers there, I am closing this one. – schroeder Dec 27 '17 at 9:15

Browse other questions tagged or ask your own question.