Upload:
10:36 AM 05/31/2023
Description
The software is highly encapsulated. Reversion will be the guide to uncover the hidden message. Hint's can be provided when asked.
NANOBOT on 11:42 AM 06/01/2023: Hello brother i need your help in some of my project share your telegram id so we can deal there paid work
devsoft on 2:28 PM 06/01/2023: You can send an email to = geren93888@ratedane.com
with your questions, although I hope they'r related to this.
catears on 11:46 AM 06/04/2023: Immediately found a URL in the decompiled program that downloads an EXE file from dropbox (strange?) that my anti-virus flagged immediately before I was able to analyze it (stranger?) and then when I tried to download it a second time from dropbox I now get a 404.
devsoft on 1:12 PM 06/04/2023: Nop not weird at all, friend. The new exe that it's getting flag is compressed to the max, still is too big to be hosted here. The second exe you see, it's protected and the injector of .NET is getting flagged. It's gets without saying that you should open an exception. Extract the .NET managed code and once you extract the data you'll realize how to solve it.
thebovl on 1:18 PM 06/05/2023: 404
devsoft on 1:33 PM 06/05/2023: I hate to do this, but since it's the only way = aHR0cHM6Ly90aW55dXJsLmNvbS9NUkdPT0RMSUZF
Again, the data is just too much to compress, and all of that data is needed.
devsoft on 3:37 PM 06/05/2023: I've been investigating the 404 issue. It seems dropbox marked my file as insecure. The new one has a VirtualFileSystem Layer to evade common systems. If anyone else has a problem running this one until it asks for a key, just mention.
devsoft on 4:44 PM 06/06/2023: @NANOBOT, that mail is gone, i'l leave discord
Discord = leonardo0011
DZghost on 6:11 AM 06/10/2023: this crackme is a malware downloader, after he downloaded, a process.Start() function will execute it !!
devsoft on 9:19 AM 06/10/2023: @DZghost, well I guess you are not familiarized with packers right? No pall, the packer is protecting a Bitmap library and a PNG with 6mb. And now no one needs more info to resolve this... The Packers are DOTNETREACTOR and Turbo Studio... Resolve this inside a VM in case you are afraid. Any doubt you can ask, but beware your accusations.
You must me logged to submit a solution