Overview

overview

9

Static

static

7

crunchyroll 16k.zip

windows7-x64

1

crunchyroll 16k.zip

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    crunchyroll 16k.zip

  • Size

    7.5MB

  • Sample

    230501-wj669sbb66

  • MD5

    175b5d04ac39a76484ac7722c5f8b1c5

  • SHA1

    fe75e3f718981b2de331e4e3e961a253f1633eb1

  • SHA256

    77fc5ec417f5bd3837d0ce042658ab25765b34450e7c08d269b38eec193bff0a

  • SHA512

    c52e61e6e25588dd583385d6115484eabdfb9a29a61b9268da4a2e978c32b2283db1c8f0db5f064f46d9ece4d449170a01e98c21b08e568cc07311b99c1e5ee6

  • SSDEEP

    196608:zi5QY3cTQGfR+1+bRolV40B2tbhASBoJ9vq0Ha86BRvk:aq3R+1+ClV49RpBov88d

Score
9/10
agilenetevasionthemida

Malware Config

Targets

    • Target

      crunchyroll 16k.zip

    • Size

      7.5MB

    • MD5

      175b5d04ac39a76484ac7722c5f8b1c5

    • SHA1

      fe75e3f718981b2de331e4e3e961a253f1633eb1

    • SHA256

      77fc5ec417f5bd3837d0ce042658ab25765b34450e7c08d269b38eec193bff0a

    • SHA512

      c52e61e6e25588dd583385d6115484eabdfb9a29a61b9268da4a2e978c32b2283db1c8f0db5f064f46d9ece4d449170a01e98c21b08e568cc07311b99c1e5ee6

    • SSDEEP

      196608:zi5QY3cTQGfR+1+bRolV40B2tbhASBoJ9vq0Ha86BRvk:aq3R+1+ClV49RpBov88d

    Score
    9/10
    agilenetevasionthemida

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

5
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks