Inconsistency on file with hash d75d526893b503ab81c6298bab91083a7a9da35adce0709433c10e925592d0c6 #6

Hi Brian! As promised, with only a year's delay 😊 , a bug report on a sample. GetNETGUIDs reports:

monodis is reporting:

.module Stealer_.exe // GUID = {4E0B13F0-8B06-4380-8BBA-A0B5A9783498}

However, when I use a disassembler such as IlSpy or JustDecompile, they both report:

[assembly: Guid("bfc92ab4-fba6-4186-b6c1-331ba216e7fc")]

In case this is relevant, the file is obfuscated with SmartAssembly. I'm not entirely sure what's wrong here and neither if it's at all related to a bug with GetNETGUIDs.