Confuser.Core 1.6.0+447341964f Unpack Malware

[NubezGT]

As far as I know, the file gets the actual malware (RAT to be specific) file from the resources and opens it. I'm stuck on the string decryption part.

It's protected with Confuser.Core 1.6.0+447341964f

The assembly is .NET, C#

LinkApprove.exe

Edited August 6, 2022 by NubezGT