[LATEST] SILVERBULLET PRO 1.5.9 ⛥ LEAKED

Thanks For Cracking

(7 months ago)eagle506 Wrote:

SilverBullet Pro v1.5.9 Leaked

This is a Paid $169 Program which IMO should be crowd-funded instead of being paid if they really want to make it a good program.





Changelog:
? + Added Java code execution
+ All reported bugs fixed
+ Packages updated

Needs .NET 8.0.2 runtime desktop to run -> https://dotnet.microsoft.com/en-us/downl...dotnetcore

Download:

thanks broo

thankkkkkk youuuuuu

(7 months ago)eagle506 Wrote:

SilverBullet Pro v1.5.9 Leaked

This is a Paid $169 Program which IMO should be crowd-funded instead of being paid if they really want to make it a good program.





Changelog:
? + Added Java code execution
+ All reported bugs fixed
+ Packages updated

Needs .NET 8.0.2 runtime desktop to run -> https://dotnet.microsoft.com/en-us/downl...dotnetcore

Download:

---

MALWARE BEHAVIOR REPORT: SilverBulletPro.exe

SUMMARY
.NET loader. It installs persistence, adds Defender exclusions for its own
files, and launches legitimate .NET binaries (AppLaunch.exe, MSBuild.exe),
most likely to run a payload through them.

BEHAVIOR (in order)
1. Self-copy
   - Copies itself to %APPDATA%\ServiceWin\StartNvidia.exe (1,016,320 bytes)
   - Hides the ServiceWin folder
   - Timestomps the copied file

2. Defender tampering
   - Runs powershell.exe -NoProfile -Command "Add-MpPreference ..."
   - Adds ExclusionPath and ExclusionProcess for:
       %APPDATA%\ServiceWin\StartNvidia.exe
       C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
       C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

3. Persistence
   - Writes %TEMP%\StartNvidia.xml
   - schtasks /create /tn "StartNvidia" /xml "%TEMP%\StartNvidia.xml" /f
   - Task name imitates NVIDIA to blend in

4. Re-installation loop
   - schtasks /delete /tn "StartNvidia" /f, then /create again (twice)
   - Likely checks that persistence survives

5. Payload execution
   - Spawns AppLaunch.exe and MSBuild.exe with no arguments
   - Heavy memory activity in both (thousands of NtProtectVirtualMemory /
     NtFreeVirtualMemory calls)
   - Known pattern for running a payload inside a trusted process

6. Persistence check
   - AppLaunch.exe runs: schtasks /query /tn "StartNvidia"

7. Anti-debug
   - Repeated IsDebuggerPresent calls

LIMITS OF THIS ANALYSIS
- No direct proof of process injection/hollowing. The 7 NtWriteVirtualMemory
  calls look like normal process-creation writes. Injection is inferred from
  the pattern only.
- No network activity seen (no socket/AFD calls). Either the payload did not
  reach a C2 server during the run, or the trace does not capture network calls.
- To identify the payload (stealer, RAT, etc.): dump memory from AppLaunch.exe
  or MSBuild.exe, or decompile the .NET sample with dnSpy.

IOCs
- File:  %APPDATA%\ServiceWin\StartNvidia.exe
- File:  %TEMP%\StartNvidia.xml
- Task:  Scheduled task "StartNvidia"
- Defender exclusions for the three paths above
- Parent/child: SilverBulletPro.exe -> powershell.exe, schtasks.exe,
                AppLaunch.exe, MSBuild.exe

Thank you!

thank you for uploading

(7 months ago)eagle506 Wrote:

SilverBullet Pro v1.5.9 Leaked

This is a Paid $169 Program which IMO should be crowd-funded instead of being paid if they really want to make it a good program.





Changelog:
? + Added Java code execution
+ All reported bugs fixed
+ Packages updated

Needs .NET 8.0.2 runtime desktop to run -> https://dotnet.microsoft.com/en-us/downl...dotnetcore

Download:

TYTY

Merci mon garrrrrrrrrrrrs

ok nigga at least 10 charecters

(7 months ago)eagle506 Wrote:

SilverBullet Pro v1.5.9 Leaked

This is a Paid $169 Program which IMO should be crowd-funded instead of being paid if they really want to make it a good program.





Changelog:
? + Added Java code execution
+ All reported bugs fixed
+ Packages updated

Needs .NET 8.0.2 runtime desktop to run -> https://dotnet.microsoft.com/en-us/downl...dotnetcore

Download: