General
-
Target
Crunchyroll_p_.exe
-
Size
9.2MB
-
Sample
230501-wh338aba69
-
MD5
e7d1a006917f10e419f0e506a98e385b
-
SHA1
14b28ce35fbeafe10d629ffd7a12ac017876bfda
-
SHA256
c66f10a5fc23b02ad11b77786c17ea54f68912156cafb227bfef5aab69b38b91
-
SHA512
af34bcd208d9e3e2a1c1af2147bff2cc6a44e1008181410e4ba377e0d902cc7dc0a077d575c167dec059fa27af6123e3690512934b19d23618e51794b41af6b6
-
SSDEEP
98304:HD6asPKgZViQqyYiwdLTgmOSjr4Wz3Wch+jMnlL0jaDvLZsDawHm+tiyOweb8xI1:j6asPZ3LqjxFBz+uD19wG+tivwebr3n
Behavioral task
behavioral1
Sample
Crunchyroll_p_.exe
Resource
win7-20230220-en
Malware Config
Targets
-
-
Target
Crunchyroll_p_.exe
-
Size
9.2MB
-
MD5
e7d1a006917f10e419f0e506a98e385b
-
SHA1
14b28ce35fbeafe10d629ffd7a12ac017876bfda
-
SHA256
c66f10a5fc23b02ad11b77786c17ea54f68912156cafb227bfef5aab69b38b91
-
SHA512
af34bcd208d9e3e2a1c1af2147bff2cc6a44e1008181410e4ba377e0d902cc7dc0a077d575c167dec059fa27af6123e3690512934b19d23618e51794b41af6b6
-
SSDEEP
98304:HD6asPKgZViQqyYiwdLTgmOSjr4Wz3Wch+jMnlL0jaDvLZsDawHm+tiyOweb8xI1:j6asPZ3LqjxFBz+uD19wG+tivwebr3n
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-