krampus[.]rar | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

krampus.rar
Size

12.6MB
MD5

91ca00a1ef292ac54dd6a88aec3c20a0
SHA1

39b9adc83b78c77af5f14409f99a194920fa7205
SHA256

402bcb097fe94f79072e2372d5e082dd0d91d6b8dc3f66435a7fc3f143adc33f
SHA512

a531f5dce2039a9ca0ecad26d3b8d18c7b5e9feb22d9b5d21eaab23493320f9d5f30dc034335bd416706fb7b10ef27b3b51cbd20fc9ed70f0eee43254d009c8c
SSDEEP

393216:ec8FNsBLVoNTJFQ+QoIYQSo4j4WVUX5KpEUVr+:ejuB6NTJkoIkVKX5EEya

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack001/krampus/bypass.exe	vmprotect

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/krampus/9WTn3BjK3u2drMyMpZtkaOc.exe
unpack001/krampus/bypass.exe

Files

krampus.rar
.rar

Password: eHjDwEjMab0HJo95F26uZIv
krampus/9WTn3BjK3u2drMyMpZtkaOc.exe
.exe windows:5 windows x64 arch:x64

Password: eHjDwEjMab0HJo95F26uZIv

1b57bcd04d0f2639f5674ffc0b9f3f34

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcrt

__C_specific_handler

shell32

SHGetFolderPathW

python311

PyObject_GC_Del

wtsapi32

WTSSendMessageW

user32

GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 264KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
krampus/bypass.exe
.exe windows:6 windows x64 arch:x64

Password: eHjDwEjMab0HJo95F26uZIv

5f85c353cf9895ecc2a751010283213a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__C_specific_handler

kernel32

DeleteCriticalSection
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

wtsapi32

WTSSendMessageW

user32

GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

Sections

.text
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 7.4MB - Virtual size: 7.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
krampus/token.txt

Sharing

General

Malware Config

Signatures

Files

Password: eHjDwEjMab0HJo95F26uZIv

Password: eHjDwEjMab0HJo95F26uZIv

1b57bcd04d0f2639f5674ffc0b9f3f34

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

shell32

python311

wtsapi32

user32

Sections

.text Size: - Virtual size: 264KB

.data Size: - Virtual size: 12KB

.rdata Size: - Virtual size: 35KB

.eh_fram Size: - Virtual size: 4B

.pdata Size: - Virtual size: 6KB

.xdata Size: - Virtual size: 8KB

.bss Size: - Virtual size: 7KB

.idata Size: - Virtual size: 14KB

.CRT Size: - Virtual size: 96B

.tls Size: - Virtual size: 16B

.vmp0 Size: - Virtual size: 4.1MB

.vmp1 Size: 6.0MB - Virtual size: 6.0MB

.reloc Size: 512B - Virtual size: 216B

.rsrc Size: 1KB - Virtual size: 1KB

Password: eHjDwEjMab0HJo95F26uZIv

5f85c353cf9895ecc2a751010283213a

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

wtsapi32

user32

Sections

.text Size: - Virtual size: 30KB

.rdata Size: - Virtual size: 7KB

.data Size: - Virtual size: 2.7MB

.pdata Size: - Virtual size: 384B

.00cfg Size: - Virtual size: 16B

.tls Size: - Virtual size: 16B

.vmp0 Size: - Virtual size: 3.4MB

.vmp1 Size: 7.4MB - Virtual size: 7.4MB

.reloc Size: 512B - Virtual size: 228B

.rsrc Size: 1024B - Virtual size: 840B

.text
Size: - Virtual size: 264KB

.data
Size: - Virtual size: 12KB

.rdata
Size: - Virtual size: 35KB

.eh_fram
Size: - Virtual size: 4B

.pdata
Size: - Virtual size: 6KB

.xdata
Size: - Virtual size: 8KB

.bss
Size: - Virtual size: 7KB

.idata
Size: - Virtual size: 14KB

.CRT
Size: - Virtual size: 96B

.tls
Size: - Virtual size: 16B

.vmp0
Size: - Virtual size: 4.1MB

.vmp1
Size: 6.0MB - Virtual size: 6.0MB

.reloc
Size: 512B - Virtual size: 216B

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: - Virtual size: 30KB

.rdata
Size: - Virtual size: 7KB

.data
Size: - Virtual size: 2.7MB

.pdata
Size: - Virtual size: 384B

.00cfg
Size: - Virtual size: 16B

.tls
Size: - Virtual size: 16B

.vmp0
Size: - Virtual size: 3.4MB

.vmp1
Size: 7.4MB - Virtual size: 7.4MB

.reloc
Size: 512B - Virtual size: 228B

.rsrc
Size: 1024B - Virtual size: 840B