Overview

overview

7

Static

static

7

krampus.exe

windows7-x64

7

krampus.exe

windows10-2004-x64

7

krampus.exe

macos-10.15-amd64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    krampus.exe

  • Size

    5.6MB

  • Sample

    240811-asjxfawcqm

  • MD5

    e3f7cfc15aecea1f817fd9e1c91b2b33

  • SHA1

    4427bc42173e964762c4f003628502ec601d45c0

  • SHA256

    64706688105210a3c3d265aceb11475e38bc1f35ffcd72a8d38bacc0806653eb

  • SHA512

    ed233e15a3d3947feb95c388355d7a8b05a06b2c74997b80dba331facf991f57ae252976a2465bec74c13075d06fa5cdc1930ee8e87da830e6bd1821f8eb2733

  • SSDEEP

    98304:R4UGDPt5D8brm4+Bo4M4du9I0y1ZKnnyZhK9iYRiBSqXGijc/Elh:R4/PD8m4IAOsI0fyiwS/iYsh

Score
7/10
discoveryevasionmacosvmprotect

Malware Config

Targets

    • Target

      krampus.exe

    • Size

      5.6MB

    • MD5

      e3f7cfc15aecea1f817fd9e1c91b2b33

    • SHA1

      4427bc42173e964762c4f003628502ec601d45c0

    • SHA256

      64706688105210a3c3d265aceb11475e38bc1f35ffcd72a8d38bacc0806653eb

    • SHA512

      ed233e15a3d3947feb95c388355d7a8b05a06b2c74997b80dba331facf991f57ae252976a2465bec74c13075d06fa5cdc1930ee8e87da830e6bd1821f8eb2733

    • SSDEEP

      98304:R4UGDPt5D8brm4+Bo4M4du9I0y1ZKnnyZhK9iYRiBSqXGijc/Elh:R4/PD8m4IAOsI0fyiwS/iYsh

    Score
    7/10
    discoveryvmprotectevasion

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks