xworm | Krampus[.]zip | Triage

Resubmissions

03/05/2024, 16:22

240503-tvbhmadg88 10

03/05/2024, 16:15

240503-tqn8xsah4w 10

Sharing

Copy URL Twitter E-mail

General

Target

Krampus.zip
Size

240KB
MD5

bea1685acb77fc33414d933be4f778fb
SHA1

edb1681453ae879d4d96a4c3ed14297c05db3cad
SHA256

a3ee2523823ed4f4970e9ccbcec8046e13101fc32e9621e59fd47b67c0faab4c
SHA512

b35a44c64ba29c125bddab996adac4e7a598539357847e40af37fa605a7eba6b611758d24a8577bfcd00d41019de6dc02027fcb06ceb3f2cd8d4987645a76c0c
SSDEEP

6144:lJqsZgNaDgcS9ONha3/d9+tk4p8HDIxu1FFSg9O+r:pkak/9UalkkmsIySm

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%ProgramData%
install_file
USB.exe
pastebin_url
https://pastebin.com/raw/a1kmrNub

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
static1/unpack001/Krampus/B1OdUv8CBH.exe	family_xworm

Xworm family
xworm

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Krampus/B1OdUv8CBH.exe

Files

Krampus.zip
.zip
Krampus/B1OdUv8CBH.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Krampus/UserManual.txt
Krampus/fuckkrampus.png
.png
Krampus/readme.txt