Analysis
-
max time kernel
139s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
06-05-2024 22:16
Static task
static1
Behavioral task
behavioral1
Sample
krampus.zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
krampus/krampus/Loader5.4.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
krampus/krampus/READ ME (ro-exec).txt
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
krampus/krampus/README IF DOSEN'T WORK.txt
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
krampus/krampus/backup.zip
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
krampus/krampus/ezdebug.png
Resource
win10-20240404-en
General
-
Target
krampus/krampus/backup.zip
-
Size
22KB
-
MD5
9b89aadbad03a6808ff6c5f24ee58466
-
SHA1
6eb9940bb7510cac5d9e88585a24ac71c6ff7000
-
SHA256
1f0973e75b0e859028c3793418b40430a2eaa54ab08506607177db4c769c5930
-
SHA512
230cc216bcfd5eda4a6a99b4b8f1f7306b39bceeebb5c5fac664650221c3472be98188dd0bc5a52b4506cec81c8ff44e093e9a3fcf0c6d23051669f8b7ffddb4
-
SSDEEP
384:S/It0+C+eTo9doqEsACmZWXo/KNhArDWOA7eJiEBmC8nBwxJhbSDGZ:x++Jio9doqZrmWXtGmveEEMC06XhboA
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4544 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4544 vlc.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4544 vlc.exe 4544 vlc.exe 4544 vlc.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 4544 vlc.exe 4544 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4544 vlc.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\krampus\krampus\backup.zip1⤵PID:4448
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4544