KURO[.]exe | Triage™

Resubmissions

08/09/2026, 13:41

260908-qzcpps1tbv

08/09/2026, 13:40

260908-qynetacl3v3

Sharing

Copy URL Twitter E-mail

General

Target
KURO.exe
Size 66.8MB
Sample260908-qzcpps1tbv
SHA256 dd4d35525034e78adc33a9a7c98d201d086e31f1ee5580e9c4faa55aa060ea86
MD5 22ed3286e12711028718cb843f3ec8a0
SHA1 846e434dc6e8cd83fe458b896e8aaf9033841bbd
SHA512 7e2787dd6def7b4ef7aa1f2cf525a63255012a5b8d7cb9a9b3153888d11f862b62c697ea28cea91309e151d3e3c1cedbac9fcc96648c1d7f98a15352de04e11d
SSDEEP 393216:pJm8leCPG7GRRmeeMM72QQ7+fpS/GBwCPG7GRRmeeMM72QQ7+fpS/GB+W3biLa3J:iX1GGbvw1GGbvH3biGRN1+qbwewbkD
TLSH
T195E7184252A8BCE1C036A130E7BB8FF1D769EC559228924F14D1FE473D3A643792B2E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KURO.exe

File Explorer

KURO.exe

.exe 66.8MB

KURO.exe

IMPHASH 1339cd31fcaff9b82fe12d6330b18b62
SHA256 dd4d35525034e78adc33a9a7c98d201d086e31f1ee5580e9c4faa55aa060ea86
MD5 22ed3286e12711028718cb843f3ec8a0
SHA1 846e434dc6e8cd83fe458b896e8aaf9033841bbd
SHA512 7e2787dd6def7b4ef7aa1f2cf525a63255012a5b8d7cb9a9b3153888d11f862b62c697ea28cea91309e151d3e3c1cedbac9fcc96648c1d7f98a15352de04e11d
SSDEEP 393216:pJm8leCPG7GRRmeeMM72QQ7+fpS/GBwCPG7GRRmeeMM72QQ7+fpS/GB+W3biLa3J:iX1GGbvw1GGbvH3biGRN1+qbwewbkD
TLSH
T195E7184252A8BCE1C036A130E7BB8FF1D769EC559228924F14D1FE473D3A643792B2E5
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1044528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\naruto\AppData\Local\Temp\reiman_build\KURO.pdb

d3d9

Direct3DCreate9

kernel32

GlobalUnlock ReadFile SizeofResource SetNamedPipeHandleState Process32First WriteProcessMemory CreateNamedPipeA GetCurrentProcess WriteFile TerminateProcess InitializeCriticalSectionEx FindResourceA GetCurrentThreadId DisconnectNamedPipe OpenProcess CreateToolhelp32Snapshot Sleep GetLastError GetFileAttributesA Process32NextW CreateFileA LockResource Process32Next Process32FirstW CloseHandle LoadResource VirtualAllocEx LocalFree DeleteCriticalSection GetModuleHandleW CreateRemoteThread VirtualFreeEx ConnectNamedPipe GetComputerNameA GetFileSizeEx HeapAlloc HeapFree MapViewOfFile GlobalLock FreeLibrary OutputDebugStringW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter WakeAllConditionVariable SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx MoveFileExW AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA WideCharToMultiByte GlobalFree GlobalAlloc MultiByteToWideChar QueryPerformanceCounter GetTickCount GetProcAddress QueryPerformanceFrequency CreateFileMappingA LoadLibraryA LoadLibraryW UnmapViewOfFile

user32

GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode DispatchMessageA GetWindowRect DestroyWindow SetWindowPos SetWindowRgn GetSystemMetrics GetClientRect SetCursor RegisterClassExW ShowWindow PostThreadMessageA MoveWindow UnhookWindowsHookEx DefWindowProcA BringWindowToTop TranslateMessage SetCapture GetForegroundWindow UnregisterClassW LoadIconA PeekMessageA GetWindowLongPtrA PostQuitMessage SetWindowLongPtrA UpdateWindow GetAsyncKeyState MapVirtualKeyA GetKeyNameTextW OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData CreateWindowExW GetKeyState LoadCursorA ScreenToClient TrackMouseEvent ClientToScreen GetCapture

gdi32

CreateRoundRectRgn

advapi32

OpenProcessToken GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorA ConvertSidToStringSidA GetUserNameA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ _Query_perf_frequency _Query_perf_counter ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ

d3dx9_43

D3DXCreateTextureFromFileInMemory

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

winmm

PlaySoundA

wininet

InternetConnectA InternetOpenA HttpSendRequestA InternetSetOptionA HttpOpenRequestA InternetReadFile InternetCloseHandle

urlmon

URLDownloadToFileA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy _CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception memcmp memchr memset memmove memcpy longjmp strrchr __std_terminate strchr strstr __std_exception_copy __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_c_exit system _register_thread_local_exe_atexit_callback _exit _initterm_e _initterm _register_onexit_function _get_narrow_winmain_command_line _wassert abort _errno _set_app_type _seh_filter_exe _cexit terminate _configure_narrow_argv _crt_atexit _beginthreadex _initialize_narrow_environment _initialize_onexit_table exit

api-ms-win-crt-stdio-l1-1-0

fputc __stdio_common_vsprintf_s fgetc fgetpos __stdio_common_vsscanf fread _get_stream_buffer_pointers __stdio_common_vsprintf _wfopen fwrite _fseeki64 __stdio_common_vfprintf fseek fclose fflush __acrt_iob_func ftell setvbuf _set_fmode __p__commode fsetpos ungetc

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh

api-ms-win-crt-string-l1-1-0

_stricmp strcpy_s strncmp strcmp strncpy strlen wcslen

api-ms-win-crt-convert-l1-1-0

strtol strtoull strtod atof strtoll atoi

api-ms-win-crt-math-l1-1-0

asin sinf sqrt sqrtf logf __setusermatherr cos atan2f cosf log fmodf pow ceilf _dsign acosf sin powf

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func