Overview

overview

10

Static

static

10

Krampus/B1...BH.exe

windows10-1703-x64

10

Krampus/B1...BH.exe

windows11-21h2-x64

10

Krampus/wo...8b.exe

windows10-1703-x64

1

Krampus/wo...8b.exe

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    Krampus.zip

  • Size

    1.6MB

  • MD5

    aa83975db362f2c1c30cd94bf9f64e78

  • SHA1

    a81e064674766382006b7bcfe7eb97cbf8993493

  • SHA256

    e28a13262f71c3b11cd1955f3c26002b44c289683a58a75f3dd95894c274efa6

  • SHA512

    4de475a23ca0a160e74f7662bb309557907f0b3fd9c1b68dc16d9ac09a8048070a288fdf8bdc5fb6e7d948b871c21be909f4bb560daef55f3544aee81effb9eb

  • SSDEEP

    24576:SJfkFLBCypRVKVxrjK6FEmqdE2hAHAMP5t71VwqCm3suWVgHj4ZCWSKSGO2fFFi:IQ/fexlCFE2hApP5p1mqmhNwWSEbfy

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    USB.exe

  • pastebin_url

    https://pastebin.com/raw/a1kmrNub

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • Krampus.zip
    .zip
  • Krampus/B1OdUv8CBH.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Krampus/UserManual.txt
  • Krampus/fuckkrampus.png
    .png
  • Krampus/readme.txt
  • Krampus/workspace/ftoTig6t8b.exe
    .exe windows:6 windows x64 arch:x64

    10af48964ca0dc2b8bfb1d86a7e27863


    Headers

    Imports

    Sections

  • Krampus/workspace/workspace/IY_FE.iy