Post #1851407

@james_inthe_box Just with a quick glance (it's .NET, not obfuscated), I would have expected the encryption to work. It searches for any file in the Desktop, Documents, and Downloads directories, then loops through until 100 files have been processed. If anything does manage to be encrypted...they also use a hardcoded AES key and IV. Recovery should be trivial. ¯(ツ)/¯ key: NanoCoreKey12345 iv: NanoCoreIV67890 The binary also acts as a stealer and keylogger. Plenty of easy to read functionality. EDIT: This binary basically tries to do a little bit of everything.