Skip to content

[alphv_blackcat] Wrong make commands for InfoStealer #39

@arty-hlr

Description

@arty-hlr

Hi,

To build InfoStealer, two options are provided, either use cmake, or the dotnet commands directly. The dotnet publish command in https://github.com/attackevals/ael/blob/main/ManagedServices/alphv_blackcat/Resources/infostealer/infostealer/CMakeLists.txt#L7 does not correspond because of --sc false, which results in an error when executing on another machine because of missing library.

I believe the correct command should be the following:

dotnet publish InfoStealer.sln -r win-x86 -p:PlatformTarget=x86 -p:PublishSingleFile=true --sc true -c Release -p:IncludeNativeLibrariesForSelfExtract=true

with explicit mention of --sc true to make it self contained, this should probably be also fixed in the manual command mentioned here as it only uses the parameter.

Could you also provide more information on the environment used to build it? When I build it on my dev machine, it uses netcoreapp3.1 and not net6.0-windows as mentioned in the path to the release binary. This is not an issue in itself as it also runs when built self contained, but it would be nice to have more information on the original build environment.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions