Download bundle index for the FUD Crypt VerShadow VERSION.dll carrier write-up.

Primary public artefact repository:

• taogoldi/analysis_data/fudcrypt_vershadow_apr_2026

Direct folders:

• scripts/ decrypt_stage2.py (RC4 + 32-byte rolling SUB+XOR pipeline)
• detection/ YARA rules (also mirrored at YARA/loaders/fudcrypt/)
• reports/json/ structured static + dynamic + cross-reference report
• images/ Mermaid sources and rendered diagrams (kill chain, CLR sequence, DLL search order)
• docs/ blog source markdown

Key external references:

• Hybrid Analysis: loader full sandbox report
• Hybrid Analysis: stage-2 .NET payload
• Ctrl-Alt-Intel: Dissecting FudCrypt
• Splunk: Windows Hijack Execution Flow Version Dll Side Load

The carrier executable, the encrypted catbox blob, and the decrypted .NET assembly are not redistributed in this bundle. Analysts who want them can pull from the upstream sources above.