DFFDFD.zip
- SHA256 a71cbc4074b4eece9b98c4da5835bd9af06443a9945432e690849e0133a24bb1
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DFFDFD/kuroko-rat-cpp/build.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral2
Sample
DFFDFD/kuroko-rat-cpp/build.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
600 seconds
Behavioral task
behavioral3
Sample
DFFDFD/kuroko-rat-cpp/client/build_client.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral4
Sample
DFFDFD/kuroko-rat-cpp/client/build_client.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
600 seconds
Behavioral task
behavioral5
Sample
DFFDFD/kuroko-rat-cpp/kuroko_c2.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral6
Sample
DFFDFD/kuroko-rat-cpp/kuroko_c2.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
General
- Target DFFDFD.zip
- Size 532KB
- Sample260925-na2anavaph
- SHA256 a71cbc4074b4eece9b98c4da5835bd9af06443a9945432e690849e0133a24bb1
- MD5 92b92737f32a41f521becd146284c10e
- SHA1 fa910d71292564e0932aee36abdce2b0c09607f4
- SHA512 1941a13ddfaffafc06a5f97ce8de26f2e01654c8a038cc798e4fbe49c9e30d31331aac72b8f3084172bae46d1aa365a1cefb7dda01a74c7148a8c8e8776a8ab2
- SSDEEP 12288:Ug5MJn5HOfEI4OKhhQlKItaEObdb6+RuvnTlWHMutmcwTAAjp6+rJ:UnJdOEI4D8l5taj0+4vnIHMQwTLp6+rJ
- TLSH T1C1C4230A9150E85ACFF2E73C9C61C800012471D59611E69F2D1A6D6FFE7ECE9AC3EA4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/DFFDFD/kuroko-rat-cpp/kuroko_c2.exe
File Explorer
-
DFFDFD.zip.zip 532KB
-
DFFDFD/kuroko-rat-cpp/README_FEATURES.md9KB
-
DFFDFD/kuroko-rat-cpp/README_HOWTO.md7KB
-
DFFDFD/kuroko-rat-cpp/build.bat1KB
-
DFFDFD/kuroko-rat-cpp/client/browser_stealer.hpp21KB
-
DFFDFD/kuroko-rat-cpp/client/build_client.bat1KB
-
DFFDFD/kuroko-rat-cpp/client/client_main.cpp19KB
-
DFFDFD/kuroko-rat-cpp/client/extras.hpp16KB
-
DFFDFD/kuroko-rat-cpp/client/injector.hpp3KB
-
DFFDFD/kuroko-rat-cpp/client/misc.hpp12KB
-
DFFDFD/kuroko-rat-cpp/client/persistence.hpp5KB
-
DFFDFD/kuroko-rat-cpp/client/recon.hpp10KB
-
DFFDFD/kuroko-rat-cpp/client/screenshot.hpp2KB
-
DFFDFD/kuroko-rat-cpp/client/shell.hpp3KB
-
DFFDFD/kuroko-rat-cpp/client/stealer.hpp12KB
-
DFFDFD/kuroko-rat-cpp/crypto.hpp11KB
-
DFFDFD/kuroko-rat-cpp/kuroko_c2.exe.exe 1.5MB
-
DFFDFD/kuroko-rat-cpp/network.hpp2KB
-
DFFDFD/kuroko-rat-cpp/server.cpp37KB
DFFDFD/kuroko-rat-cpp/README_FEATURES.md
- SHA256 652f0e2e58251b3f067f8d8b95f3af93dfb743786c09ace076acae2db27cc816
- MD5 93d69818c8bd7a7bbfd28ccf273c3c93
- SHA1 9dee10b6478a5482463bb697f05f51a530980b4b
- SHA512 bb595b72f633bee03aab0a3d38dd1b5cc539d685bcfb8ed0511944db4d306565cd59589bff47fcb91a41d578fe893dbbd2068ddb0eccbe7d92f209ec32acfdfa
- SSDEEP 192:gAoI2/mWfeWS2/9cqkE0UHywMQwWD3WVHrQYT1ShI0CV7JQ81YY3UrU:joIWvfeWS2iZMrM5WbeT1b06jUrU
- TLSH T1D012F7D35EB8262907E3E653E903AC92EF56B00572933F4045EE018CB079F5DC2AC6D6
- MD5 SHA1 SHA512 SSDEEP TLSH
DFFDFD/kuroko-rat-cpp/README_HOWTO.md
- SHA256 a86dcf3c28d42ca220c2f3953d52be729468f1bebe2f879268c3f2863d433193
- MD5 9139f8ae86e74a6960afe9547654a2ca
- SHA1 531d22f24f1e2e9dfcc95220ad974288ea6ccfb3
- SHA512 76a003e530fb5c1a243854928edf96dc4ebf381ded640246db3fe473e7ff5a04382fce5b1a3ca9f00d1c5175cbc83e4a403b129b5d3b852a91d8c0b6e483076c
- SSDEEP 96:SFVbVAXvuAydug58Za62y52EnjnpHE6QDw40GaEdRpMlGvITPjiqCbksYX1erK+0:aSgqE1EtPQDPGUh0iqC+X1erKMDJ7ds
- TLSH T1CEE12C16222A33B326B782D7560FF2E0FB34A069B267712936AF509C3754526C3FD0A5
- MD5 SHA1 SHA512 SSDEEP TLSH
DFFDFD/kuroko-rat-cpp/build.bat
- SHA256 1dee2779e814abe749d4e7906dbd20785cc24a795af94b8f12b0ae038c1af798
- MD5 d50b7033b0e3283f564d7ddcb40cec9b
- SHA1 6d38d8b8aa971a59e4c04821e2fac765f944d9a9
- SHA512 5d1eb7721d62993740823a1d0621758912c9b015f74a940a92b627246fd6bbfd717bd46bbf818f5d093f19b053366e0b8779d399a2f163fdc00249a4a1b4623b
- TLSH T1CD31F03594050521329BDD9DAB20B490E729761B74D80C58B1FF71991FEC1C62CFE8F0
- MD5 SHA1 SHA512 TLSH
DFFDFD/kuroko-rat-cpp/client/browser_stealer.hpp
- SHA256 5fdc9490a43c10c64c86ffe323f4dcbdd515e40f7442d1f9c451de055e120c45
- MD5 fa1537e028682bb31027f18e9ceae4d1
- SHA1 56ed8666d16a22e5e0a08a2652b4925cc77cc5a0
- SHA512 33b44b313354f4056f60482505000ba0dad359ddced57d0c71f53300da63b7c8ab82fe693917e4a489c57345a38b83b2d7b61b0575273282deafab8684b4a177
- SSDEEP 384:eHw6I/hGssaUdYeGmZfj8ILq2HXIf5X5hYsKCJbRAii0z2FlWCSU8x3m9wEpBNX/:mw6IJGssaUdYeGuf+2HXQ5X5hIMRAiTK
- TLSH T159A2537218E67D053942F81DEBD75502E5087013B399CBA4BA6F32A46FCF07493B86B6
- MD5 SHA1 SHA512 SSDEEP TLSH
DFFDFD/kuroko-rat-cpp/client/build_client.bat
- SHA256 70375beb2c8768eba6c6d12dd9a678302d04c65d6eb2cf02ef9fb9c2a961a5fa
- MD5 e09a894b38d8f7cae99583c7832b9311
- SHA1 dad873d1f729129e25e97ca054d500724a582dd9
- SHA512 3055104a9bbacc637e59877b9c3472989eb3e72ea579245ee2c1cdf1a912d02ffcbb84da0c7126972a46e33b154453e814b2bb019ba1bb08ff2e075dd2d95a5d
- TLSH T1C8410071A44405223646CE9E6A74F4A0D13879AB74A81D69B0EEB49E0FFC0C63DED8F0
- MD5 SHA1 SHA512 TLSH
DFFDFD/kuroko-rat-cpp/client/client_main.cpp
- SHA256 968deb48688ee2feb967545f38fd1f5c9e3dce2e6a1f3551b448527f7a347f2d
- MD5 86c09a9eb8bd5a4ba66bf9b06cf105b7
- SHA1 f570e2173affbb7bb743de4b4c4d096df2a59e15
- SHA512 d4a74fdc3c8e5393498164f19713cb9887b333c4bb247f924214b0b3dd120944eb4368df8b6e72de88cddf8f15306b33f42843a7fe8897590ce3ec8be3a17f91
- SSDEEP 384:WgaNzPyyV4rfe2A4vG+GgQG3HDug4Dgl1rJX6W:0pVue2A4vG+GgQG3ae1rF6W
- TLSH T13792723228E7AA1175A7E55C87D71C037345B2037728D6A0BCAF72C86FDC07852B59BA
- MD5 SHA1 SHA512 SSDEEP TLSH
DFFDFD/kuroko-rat-cpp/client/extras.hpp
- SHA256 4a7ccc65a109efa5950d1cfad4b162c59f89f043d2b7762653cb5c66bc8518e3
- MD5 3b3fc1c9c21060ef92e8c12b8fac8c20
- SHA1 281f80e7ff73b5f20b0ad63950ca65cd88c8eee4
- SHA512 96ad29cfc0cf648187a46cc7f347629e8ee8caeb33651aa1ed22d894ee84966859fdb88b4879b84a2cc8d2e8026cc68bc94970580b954544a7e048cb7df250a9
- SSDEEP 384:OBzUX4dSlwgY50DLw6lSPmLGYxYKsspPq:OBz04QLY50Dh8mLXxpsspPq
- TLSH T10E72407258E73D513682E42ECBEB1403A315B6037329CAB0FD5D37886FCD46952B06B6
- MD5 SHA1 SHA512 SSDEEP TLSH
DFFDFD/kuroko-rat-cpp/client/injector.hpp
- SHA256 92675bf586b3c16e8edeac22956374060f78e2631fb936914021b71bca81bb07
- MD5 7d510dcc598a54a71c3692a3503afc72
- SHA1 a6501f994dc097e3123c94f645e1b29f70cd732b
- SHA512 abfdad016c45a620c22b24d69af4471794a5dd8ba7ad7b7b1fd32faf1e4fb9fee746b0dd0c278a258c8932d79d2d6da50e29bb35e1d51b77d3b91ab32c84aa97
- TLSH T12F61938586DE8A141FFB2C7A6B0B9012F72D811B1A198E307C9E83AC6F4E06C05266D3
- MD5 SHA1 SHA512 TLSH
DFFDFD/kuroko-rat-cpp/client/misc.hpp
- SHA256 eb64ca6b0ddd1ff4f847a1232ccad5d98d61b6320c8c633bb5b227a359a9165c
- MD5 4d6627d42cd30994743035b8ad924ad8
- SHA1 e5eb6193cd5a454eb7180d2edb25587e0aeb1c8b
- SHA512 6bab92640489f9447bbc276bbbe85b6814838ae9882ae73291b20aafd9670134bf3ea6663b537d3c48e1af08ee6d204e5b1af4cce5efe3c6d9bfd5315b8f90c2
- SSDEEP 192:oUJgtFtKIiFV2GAGtNptCSQTvMedb/T2uQJTlz22GQPmjNi8HCnhsGXaTtz2yQ3Q:oUSbti7iiNLcbHxkTlq2uNi8inhDY2md
- TLSH T11F42927319961D723423E51D5BDB2011A118B20BB368E664BC8E33481FDD4B9D2B9BFA
- MD5 SHA1 SHA512 SSDEEP TLSH
DFFDFD/kuroko-rat-cpp/client/persistence.hpp
- SHA256 95effe316b4518219280294b5dfae5d2df969b2652b36667431079b290e76d7a
- MD5 d64207b1f67a4c5d13f77c85dd7de89f
- SHA1 dba81b56c09b1efe3d2ea46bca64b56d6a4f7545
- SHA512 bf8ac891253c2a0caecb16f1e0248e9bd852b99ffff60e86fd51f900f4f8bb04c5197b1b60dcb54f2026541393e26443cf0b5542f5adbdb0b44415429cb2732a
- SSDEEP 96:U9YEhPvQky9bAGvC7tnWZfx3j0f73q8u3SLjUxquDdiQ4Zy6TKk4DJTk4ULSUReU:jkiyol33MWqusNGkaJTkCq7dwFz5e
- TLSH T19DC14171E8A2ECB179B5D20E47471642F616736B77388A60F48E30581FCE4AD41766F3
- MD5 SHA1 SHA512 SSDEEP TLSH
DFFDFD/kuroko-rat-cpp/client/recon.hpp
- SHA256 6b4cf63657ec5cab8b183e2895ea4bce2651db5ea0bcd9d0297c6f9b08539488
- MD5 e2c7dc3540f3c56a6ca3d36f71988ed3
- SHA1 fee2099d4c15cfa668db68a4119a59301c7a2e32
- SHA512 eb2be43c1473298732186890e6202fad1f6919293a524f2f46e92f1d3b2207fc9ee8cb5873e0593d27aa267538399876207fc487489563dd163ec874747ac5df
- SSDEEP 192:3phJkniQnVMFF66cVF3RqmgGqQjn7bmsSp5r1NI7dVEhlMyyiQhNUyTmFtssXSrY:3IpVyLQnlSIglMxU9ss4zOIbG
- TLSH T1CB32737994FB5D107993E52D8B5B2182724A72033326C760BD8F33885FCD53A46B86FA
- MD5 SHA1 SHA512 SSDEEP TLSH
DFFDFD/kuroko-rat-cpp/client/screenshot.hpp
- SHA256 11916973761113e4c5f271f4cfdb059dc62baa956d3cde749d89601a583f1be8
- MD5 9f156cafb6808853fd3f950687120de0
- SHA1 673cfc5bf7e337efafcc6209c6a313f1e3eb43ba
- SHA512 278bbe5b3405431023b087d3d180ed0d1791ae2a0caa82bf49dd27e3a1f9cb6ce245ea1b3641da57f308d5e5694fecf91b385c1b3859af15405a6d71e63c83bb
- TLSH T1AF5177FA585B4E306E53794B7F9A3005D12460172128F6153C4F0568BF958FC5BF86E7
- MD5 SHA1 SHA512 TLSH
DFFDFD/kuroko-rat-cpp/client/shell.hpp
- SHA256 b906c1485627d469508dad94d74fbb6854a80eb643015ed939fb301fa2ed10a1
- MD5 33536a408b79d45754aa57cefed83487
- SHA1 9ea32763357b182198a9104f6653943474a6758e
- SHA512 a1a8592c391c4515f38198d4b0087ca8ebd515784100060c7ecec84214bc4d202eb482e64c345b8db20d43ef0625ada5241658255dc748985280b970b3b7427f
- TLSH T1AE71625544EF39A80673F4504FAA510AE1029317232ECB78BC9F4F106F9826CB7B87B2
- MD5 SHA1 SHA512 TLSH
DFFDFD/kuroko-rat-cpp/client/stealer.hpp
- SHA256 b397ef643b0057b050060c77f3c02a8ced61a42cd6d06f3297877992b2742b07
- MD5 2d59c5ef27fa8e2c11eaaf9b8b67219e
- SHA1 1b0c07e08cc4079f7d3403f7f0036b45c8a406c0
- SHA512 4e4c6d73b70b4f2cb1ee5620c6634d78f6ce5ddbfe42794e9c447e184a48fad38213b4d38dee85689e7eb5dab5ac8ad02444a838eadffc6dc8cdd51e9be17548
- SSDEEP 192:J6ghQ+K0bhY7niQlkickybPaSWC7yWuzKq/kSUsydOssyoNytX2+u8KTexAU1iKa:JnPOLFSWIyW2Kq8bG8Kw3sA8qHi
- TLSH T11742743A54E77E257913E46E87E76016A12870077334DA62F54E72C42FCE17922F09FA
- MD5 SHA1 SHA512 SSDEEP TLSH
DFFDFD/kuroko-rat-cpp/crypto.hpp
- SHA256 9e23300d0cce974aa7f71bca3f0cc22ff2179811a103a412e43571b9dad5c476
- MD5 21a220d9f587397bc765adef08a848cd
- SHA1 4ff33c9680c4253c58c1641c2fdf771df0f68229
- SHA512 46a072295279b10a4cb0d4429ed55c936dc240a33387b4e10bea779bd5154220ed4b006c67358ac33258e78c367afad713fbc3fc5783fee5a8e4e7a43f3587e5
- SSDEEP 192:GO8+SYQ2XE+xrr9iVM3LRN0y7uLfTGrtaA0OTOsIRiDmdRY8SomcF5SETQeaz+QR:GOlXE+xrr9iVM3Lv5M9APOLR8Cjmc3LU
- TLSH T1AD42317028E2A4813067D72D6E9D21A0B415F123B5DAEF44FC5C76866FDF07943B82BA
- MD5 SHA1 SHA512 SSDEEP TLSH
DFFDFD/kuroko-rat-cpp/kuroko_c2.exe
- IMPHASH 54679eadfa69a535394515ebcf578d39
- SHA256 3ad4f7fa5d168ce9b6933de4efb1c6603a6dcf2c42eac76d6781eb8c83bd4476
- MD5 3b9cbd459f43ed0d9d7a79254fd47d58
- SHA1 f7d531fc311e30c3bb5f6dbfbd9c336afb5c9712
- SHA512 33903753a2db076768e249d577907c2f3a7d7c763787a2c4222f7f6adea63d5f3e1cfaf14c4d55d2c160153a3276afc8a3616dcb3373582887ecb4c98c60c611
- SSDEEP 24576:ZkMXqWC4GP7YXyjyi6nillr37lNBOK6646RR7h4A:ZkM6b4GS4IK576
- TLSH T1B1654B02A7E6CDEAC89AA73891CB2719F634FC5017639BDB431052352E577D99E3EB00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4096
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
WSACleanup
WSAStartup
accept
bind
closesocket
htons
inet_ntop
inet_pton
listen
ntohs
recv
send
setsockopt
socket
comctl32
InitCommonControls
InitCommonControlsEx
bcrypt
BCryptGenRandom
gdi32
CreateFontW
CreateSolidBrush
DeleteObject
SetBkColor
SetTextColor
shell32
ShellExecuteW
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vswprintf_s
_fileno
_fseeki64
_ftelli64
_setmode
_wfopen
fclose
fflush
fopen
fputc
fputwc
fread
fseek
fwrite
getc
setbuf
setvbuf
ungetc
api-ms-win-crt-convert-l1-1-0
_strtod_l
_wtoi
mbrtowc
mbsrtowcs
strtof
strtol
strtoll
strtoul
strtoull
wcrtomb
wcrtomb_s
wcstod
wcstol
wcstoll
wcstoul
wcstoull
api-ms-win-crt-string-l1-1-0
_iswalpha_l
_iswcntrl_l
_iswdigit_l
_iswlower_l
_iswprint_l
_iswpunct_l
_iswspace_l
_iswupper_l
_iswxdigit_l
_strcoll_l
_strdup
_strxfrm_l
_tolower_l
_toupper_l
_towlower_l
_towupper_l
_wcscoll_l
_wcsxfrm_l
isdigit
isspace
isxdigit
mbrlen
memset
strcmp
strlen
strncmp
strnlen
tolower
toupper
wcscpy_s
wcslen
wcsnlen
api-ms-win-crt-runtime-l1-1-0
_assert
__p___argc
__p___argv
__p__acmdln
__sys_nerr
_beginthreadex
_cexit
_configure_narrow_argv
_crt_atexit
_errno
_exit
_initialize_narrow_environment
_initterm
_initterm_e
_seh_filter_exe
_set_app_type
_set_invalid_parameter_handler
abort
exit
strerror
strerror_s
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
___mb_cur_max_func
__pctype_func
_configthreadlocale
_create_locale
_free_locale
localeconv
setlocale
api-ms-win-crt-time-l1-1-0
_localtime64_s
_strftime_l
_time64
strftime
api-ms-win-crt-heap-l1-1-0
_aligned_free
_aligned_malloc
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-private-l1-1-0
memchr
memcmp
memcpy
memmove
user32
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
FillRect
GetClientRect
GetDlgItem
GetMessageW
GetSystemMetrics
GetWindowLongPtrW
GetWindowTextLengthW
GetWindowTextW
LoadCursorW
LoadIconW
MessageBoxW
PostMessageW
PostQuitMessage
RegisterClassExW
SendMessageW
SetWindowPos
SetWindowTextW
ShowWindow
TranslateMessage
UnregisterClassW
UpdateWindow
kernel32
AcquireSRWLockExclusive
CloseHandle
DeleteCriticalSection
EnterCriticalSection
FlsAlloc
FlsGetValue
FlsSetValue
FormatMessageA
GetActiveProcessorCount
GetCurrentThreadId
GetLastError
GetLocalTime
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetThreadId
GetTickCount
InitOnceExecuteOnce
InitializeCriticalSection
IsDBCSLeadByte
LeaveCriticalSection
LoadLibraryW
LocalFree
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlRestoreContext
RtlUnwindEx
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
SleepConditionVariableSRW
SwitchToThread
TlsGetValue
TryAcquireSRWLockExclusive
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
api-ms-win-crt-multibyte-l1-1-0
_mbtowc_l
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-environment-l1-1-0
__p__environ
getenv
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
Name
.text
Size
628KB
Virtual Size
628KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
157KB
Virtual Size
156KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.buildid
Size
512B
Virtual Size
53B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/4
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/18
Size
512B
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/58
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/70
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/82
Size
131KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/33
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
/47
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
DFFDFD/kuroko-rat-cpp/network.hpp
- SHA256 660405857460007395eec543f58059a3413b2190ca246642d6d9c3518991906a
- MD5 7a9376c1bad9a54b5acd8ec7361274a6
- SHA1 aa4935e6024b6cb2900ddd84b0d6a8ee8f745579
- SHA512 5e43afd87fcef9d97f053a568ef5d2f860bd9b87b67efdd6a464e31f143b2fc69eeb7e10c9ae7597eb652cc7a3d9c946cd5282d307f06cad43a19bb38aeb37a1
- TLSH T1E041315164F3BC91CA9B156B4BDB9022F2202877D7AED764FC9F52107F8106C82B5617
- MD5 SHA1 SHA512 TLSH
DFFDFD/kuroko-rat-cpp/server.cpp
- SHA256 1a115ddd9c2107cba27746a821ad2d954b08fd113d1219f5946249a834b357b4
- MD5 82c09933ba898f3b2cf60b3ea84ac7fe
- SHA1 63a054f02bbda4cc11830baa5a86812ae616813e
- SHA512 9f0498f2275f7940daad5c63991b235fb3b8c60950e8494ee462372e0d7e36f3c899c4ccd07752ec32464db696877061997d999d2d0951e284408dca507c7d4f
- SSDEEP 768:9g5Ufqn+q8vkVHaQoSUauQsotAPgOytfMxw:3fqnlLkQqauQso+31w
- TLSH T12903B53014F37D257477E52DEB67A44072657123B764EA28FD0EB2C89FDC0A482B86B6
- MD5 SHA1 SHA512 SSDEEP TLSH