The base64 encoded EXE inside the crunchyroll sample expects the C2 to return a length and then bytecode to be executed @bartblaze
Show this thread
-
E.g., in TinyLoader the XOR during key search happens directly to shellcode then reversed if wrong, in Crunchyroll it happens in a register.
Interesting - I haven't looked at TinyLoader yet, @sysopfb can you share the hash of that sample from your screenshot please? Thnx!
-
-
sure: 175661b3aba0195b1115af5286140f8251ed1299343687377becc5148ae903f3
-
Awesome, thank you both!
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.