@endrift@social.treehouse.systems
Post #1705128
2026-04-16 06:48 UTC
I will provide the deobfuscated virus on request if any malware analysts want it.
Replies (1)
-
@endrift@social.treehouse.systems 2026-04-16 07:28
I suspect this stage is just a payload injector that is installed into something else. The payload itself is a 781579 byte blob of x86 machine code. I suspect that payload isn't even the main payload but instead an encrypted blob and decryption stage for the final payload. But I really don't feel like tossing the blob into ghidra. SHA-256 of the machine code blob is 64f70a4cfdf24b817c795ea28b90cad23af92f640c616464bbea365d4c1c89aa.