Corz Client[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Corz Client.rar
Size 304KB
Sample260821-genf2axyf1
SHA256 11c70ba75fd9bfee1079daca5725438ec17019420705e87f373a1313ee8caa2c
MD5 94fa9d6254f1a3d70dadcc0fe9cb46d9
SHA1 8073dd92ddb3546b8f701676873ac4136507a953
SHA512 b2a20fafe5780c33346943a0feebc6d76c3b2204e603b4048346c9a185e7a87ddc0ff7c927e757026ac7309f10a45a7e46abab86dbb962e4129ca3e6465043ee
SSDEEP 6144:GmD3mMrogYPSbBxx1Wl+Pek9EIj3/U06Rz3lv/1mCx3AcOY0TpVRl:GmjmPgt9xuZnE/Bij5t5xy1l
TLSH
T19664232094266148F64F8D89A1F2884707A090D665BF7FB775CFC52F927AA424F3378A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Corz Client/Corz Client.exe

File Explorer

Corz Client.rar

.rar 304KB
Corz Client/Corz Client.exe

.exe 435KB
Corz Client/Tutorial.txt

305B

Corz Client.rar

SHA256 11c70ba75fd9bfee1079daca5725438ec17019420705e87f373a1313ee8caa2c
MD5 94fa9d6254f1a3d70dadcc0fe9cb46d9
SHA1 8073dd92ddb3546b8f701676873ac4136507a953
SHA512 b2a20fafe5780c33346943a0feebc6d76c3b2204e603b4048346c9a185e7a87ddc0ff7c927e757026ac7309f10a45a7e46abab86dbb962e4129ca3e6465043ee
SSDEEP 6144:GmD3mMrogYPSbBxx1Wl+Pek9EIj3/U06Rz3lv/1mCx3AcOY0TpVRl:GmjmPgt9xuZnE/Bij5t5xy1l
TLSH
T19664232094266148F64F8D89A1F2884707A090D665BF7FB775CFC52F927AA424F3378A
MD5 SHA1 SHA512 SSDEEP TLSH

Password

corz

Corz Client/Corz Client.exe

IMPHASH e81d90b230abc81b286482b9dba12e35
SHA256 1f94d2d02d239105f66688384d2dfe415aed56061dc5dcdba48eed19e885cc22
MD5 72b04db8d8f33087c10af504fd7a9f6e
SHA1 72a2554f26f35b035b4ac79e81c4bd02153af295
SHA512 cd67337b794b92b216eaa10d7c6814e5c4e27186dd75701bdae888fa20c6416540ce498fbe29e480cd05f7c0e03c90eac1f585ae92434a67f7dc3d2b78cabbd3
SSDEEP 6144:jUE8mRX5BmYv4wEW0xDpALOuj6U+2gOBVvsa7y/ypfZqUkTktd28:jLJ5VEbCLZjTVgKsj/ifZqhTktd
TLSH
T1D994CFD3EE40919BCD7A0B745147B7B4E5BB6FF8F9D800D228E6699A045EC8B017360B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

corz

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

256KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

163KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Corz Client.rar

Corz Client/Corz Client.exe

ntdll

kernel32

generic

Corz Client/Tutorial.txt