Overview

overview

10

Static

static

10

krampus.rar

windows7-x64

krampus.rar

windows10-2004-x64

3

Ro-exec/RE...c).txt

windows7-x64

1

Ro-exec/RE...c).txt

windows10-2004-x64

1

Ro-exec/ezdebug.png

windows7-x64

3

Ro-exec/ezdebug.png

windows10-2004-x64

3

Ro-exec/loader.exe

windows7-x64

10

Ro-exec/loader.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    krampus.rar

  • Size

    88KB

  • MD5

    ac2503cd31dca53357a49e68ea6994e2

  • SHA1

    b02ab0404058ab5798c5d94eaa51034ea4e83eb8

  • SHA256

    13a4c84d238e679f337b702d33299fa75d921d4718ca5bdb9ed4fc2072cf627e

  • SHA512

    580bab36de6f7bb8c8756a0159c59a21b46d479457f7e3fe18d6622b0651f49f6f8cbc74f32a6dc42259a61a388011abf8fd19857f92c4469cacdc35d41fce4a

  • SSDEEP

    1536:GQUqgFIsoYAqRQ36tvaOapJmA+mMA9i9GIgULI92rD3aG7mRM5DUtf2Bk/:GQgF/oYdxZaOapXd9uGzU89nG7tWtf2W

Score
10/10
xworm

Malware Config

Extracted

Family

xworm

C2

84.54.51.97:7000

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    svchost.exe

Signatures

  • Detect Xworm Payload 1 IoCs
  • Xworm family
    xworm
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • krampus.rar
    .rar
  • Ro-exec/READ ME (ro-exec).txt
  • Ro-exec/ezdebug.png
    .png
  • Ro-exec/loader.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections