The base64 encoded EXE inside the crunchyroll sample expects the C2 to return a length and then bytecode to be executed @bartblaze
-
Show this thread
-
This is TinyLoader I believe
1 reply 0 retweets 1 likeShow this thread -
-
Maybe a bit of a stretch, the similarities throw me off a bit. Below is the section that brutes it's own xor key for the embedded codepic.twitter.com/ydpT2dPL7q
2 replies 1 retweet 4 likesShow this thread
Replying to @sysopfb @mesa_matt
It does look similar - nice catch! Did you see any second-stage payload?
1:48 PM - 4 Nov 2017
0 replies
0 retweets
0 likes
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.