VirusTotal[1] and hybrid-analysis[2] info via [3]. It seems to be a very clearly targeted payload, named CrunchyViewer.exe. It could be served through a DNS hi

VirusTotal[1] and hybrid-analysis[2] info via [3]. It seems to be a very clearly targeted payload, named CrunchyViewer.exe. It could be served through a DNS hijack of some sort[8]. It's a modified version of Taiga[4], making it seem like a legitimate application and flying under many anti-malware programs' radars. Apparently the exact malware strain is currently unknown. Most likely it is ransomware that activates on reboot[5]. Given there are traces of a command and control server[2] and the Lilith open source RAT[6], the ransomware payload may be supplied by the CnC server. An overview can also be found at [7]. [1] https://www.virustotal.com/#/file/eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02/detection https://www.virustotal.com/#/file/eae53d89d7add187dfe6f4498c... [2] https://www.hybrid-analysis.com/sample/eae53d89d7add187dfe6f4498c99144d7650c37a99792e0e40035d83f73cfb02?environmentId=100 https://www.hybrid-analysis.com/sample/eae53d89d7add187dfe6f... [3] https://www.reddit.com/r/anime/comments/7aq2s7/psa_dont_enter_crunchyrollcom_at_the_moment_it/dpbxlct/ https://www.reddit.com/r/anime/comments/7aq2s7/psa_dont_ente... [4] http://taiga.moe http://taiga.moe [5] https://twitter.com/Swaps4/status/926793261884125192 https://twitter.com/Swaps4/status/926793261884125192 [6] https://twitter.com/GossiTheDog/status/926818116121841665 https://twitter.com/GossiTheDog/status/926818116121841665 [7] https://doublepulsar.com/crunchyroll-serving-remote-access-malware-dd774867c129 https://doublepulsar.com/crunchyroll-serving-remote-access-m... [8] https://twitter.com/Crunchyroll_de/status/926791185217269760 https://twitter.com/Crunchyroll_de/status/926791185217269760