ClownCS's BluePrint

Author:
ClownCS

Language:
C/C++

Upload:
2025-05-10 12:05

Download

Platform:
Windows

Difficulty:
2.5

Quality:
3.0

Arch:
x86-64

Downloads:
214

Size:
16.56 KB

Writeups:
2

Comments:
8

Description

I have a very valuable Bitcoin account list, but it has been encrypted because I ran a weird file from an anonymous email. I think I got TARGETED by the APT group....

Labels ?

Anti-debugging IsDebuggerPresent PEB BeingDebugged / NtGlobalFlag NtQueryInformationProcess CheckRemoteDebuggerPresent String / data encryption AES (encryption) Crypto / hash algorithm AES (crypto) Other / custom hash Anti-tamper / integrity

Comments (8)
Writeups (2)

You must be logged in to post a comment

ClownCS on 2025-05-10 12:13: Sorry the file must be user.json.enc instead of current name. Btw, the context this challenge is kinda bad :")) but still hope you enjoy when solving this.

ClownCS on 2025-05-13 06:54: This challenge may cause BSOD, but it's just that. It's not a malicious program. I'm so sorry if you feel annoyed.

tipikael on 2025-05-14 18:50: hi, i have problem. After launch i got BSOD, and if i open youtube i dont see anything. I download your crackme only (after that i got troubles)

tipikael on 2025-05-14 18:50: browser firefox

tipikael on 2025-05-14 19:52: upd: fixed (sorry)

ClownCS on 2025-05-15 08:34: BSOD is anti-tamper. Please use a VM when doing this crackme !!!

EloenDune on 2025-06-05 13:41: [Click to reveal]

jeffli6789 on 2026-01-04 06:25: This crackme had been reviewed when it was originally approved and is likely safe. Crackmes often get flagged by antivirus software, EDR systems, or VirusTotal because they may use the same protection techniques found in malware (packers, anti-debugging, self-modifying code, etc.), or simply a false positive. This does NOT mean the crackme is actually malicious. The only way to confirm whether something is truly malware is to reverse engineer it and find proof of malicious code and/or malicious behavior. If you still believe this is actual malware, please report it to us via email: crackmesone@gmail.com. **We encourage everyone to run crackmes in a VM (virtual machine) and exercise caution when executing unknown binaries.** *Disclaimer: We do our best to review submissions, but mistakes can happen. The administrators and crackmes.one cannot be held liable for any damages or losses resulting from the use of files downloaded from this site. Always exercise caution and use a sandboxed environment.*

Show all spoilers

You must be logged in to submit a writeup

Solution by hexamine on 2025-05-12 10:38:
cool chal :p

View

Solution by nukoneZ on 2025-06-09 08:42:
nukoneZ

View