General

  • Target

    Krampus.rar

  • Size

    5.8MB

  • MD5

    5233ef4feae855b4716111f6e1f2347e

  • SHA1

    a220baf15d0122821164aaf431601394473da632

  • SHA256

    722944284358b6e0b07d91524f7defd19b8cae3246c4e812147575432baf2afc

  • SHA512

    76a6faab525a72bb013ff46339cc4bb7154c799bce99379d40b03d77b10b0a6b16426c400e127414a2893aedfcdf7cb41284072b24f956d3f73aabd5b25e5dae

  • SSDEEP

    98304:QA/B7+WfLbxoJ0V2FHGrOxczxsEdOa+ZfxOkTL9YcZCbyQ0EuDfLBfawUCy+:QA/ZffRS08mByeObJLv4yQ0PjBBDy+

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • Krampus.rar
    .rar
  • krampus.exe
    .exe windows:6 windows x64 arch:x64

    a89bdbb5ed415ad3d3ec6aed111c65bb


    Headers

    Imports

    Exports

    Sections

  • libcurl.dll
    .dll windows:6 windows x64 arch:x64

    14248874c6f626cc676f0d1638a85bc6


    Headers

    Imports

    Exports

    Sections

  • scripts/Infinite yield.lua
    .js
  • scripts/autosaved.lua
  • scripts/betascript.lua
  • scripts/dark dex.txt
    .js
  • workspace/.tests/appendfile.txt
  • workspace/.tests/delfile.txt
  • workspace/.tests/isfile.txt
  • workspace/.tests/listfiles/test_2.txt
  • workspace/.tests/readfile.txt
  • workspace/.tests/writefile.txt
  • workspace/4483381587.rbxlx
  • workspace/4483381587.txt
  • workspace/5972698540.rbxlx
  • workspace/6af56c1753ac6679dee3acbd1fd952e5-cache.lua
    .js
  • workspace/IY_FE.iy
  • workspace/IY_FEiy
  • workspace/autoParryByFFJ.json
  • workspace/print.lua
  • zlib1.dll
    .dll windows:6 windows x64 arch:x64

    d879d2294039900ef484e0f01607f882


    Headers

    Imports

    Exports

    Sections