�%�!r:���9��f4"|�p6�P*�ͫS���pD �`��ۧ�AR���(�Ac���H{�ݢ!w�w_�"����'���c�jo�F��˘r(�Ly�vƊl��Ӆ2�9,�.�8�f����R��h�,����Ke� ���@���t���!���Қ�yɸ�cj��s��Ka�!j��D�f������G��(=�_dW��E�dR�a�P��:ܔUC�x�V͎�VYl?:q~�s+���b��rx٘4�8�ĠV���^%q���=�Y�y����AKĆx˲�����TUW{1��_(j+���J�4�HH���z�(�R@��| ��1֏^Ẽ0F`&X�O�ˏӂD�01ϬԨ�J�����~�|Kiz�Z�jŠia%���Ɓ�����(8v7����;g�A�2��pd��$��Ý���:B:�����?������y��.t_�L�-���t��y�/Ze,*�=BS�Xs=f�NՉ��+`�j/��(`�l�?Gu�����2�#� `ɑjR3��1�+@��\�W ��cs�u3��+�W�N�XLl���p���D��1�E�W�Y�<�^��P(���$K�Uğ�2�T^D �$�@Ue������Y��\ʀ��H��~��\R�R�;�څ$+iY�,+`iZ ���\H�N�q�!.t�o�@]�s��T�O5f,���Q|�Q;<M- �&�4>+���تc���ܗ�y3%L��� 9�_�����bD�P��Q"e?��U\��{�Ź>�;�$�E�ۈ����E�n!IH�8��ķ�=S�@ �n��f�Tq�߁�S�}7|�'y#�6���}'����������E�'���|���AC�qc���`��+���DEa�8��&�N�H纳"�G��V�ଦKV�&��3�V�(�!^gk��3�+p�k�@Y� �'bMt`~�E!�k@��\�q�qÒ��m��ΩL&}5g��9�b �]�j.���$\)��8 B�i���c6y!�n����k=r�� ˤZ>�V�ƈ�� ��x&��Ȋ�hEYHT��&<ȼY͘���WB�����pg�'��"���r��B˧���5��t w��&+拰u��-ce8�o���3<{�ϼ*���>Q8��Z�20I[�\+G�Vi�q�3{�������!�1d��G8�Q5����.�������EHpaVX��T���tR���{�{,6�ӝ�+"`�=�o��/��F�\<��Zf���D� ;�Y�D��<�������C���*���0�D����T����r4�M���-ۻr�^��y}�Q�z�U:e�.@�=���zn(H�C��y���!fAo��!�녀�L��5~���u`��g���5�'VȦ Ayz�7��ķ�˄A ��[m�e2��\��M̃�E�u~��WbiU���|z���5�Q[Y,*����?�#��Ɵ��ꂓ B�Gr<*>��O>9��Y�^�����;\)���Y�`̋,<Ӌ�.&�mڿQ*�p0@��f`��� ��&�1f��b �{J�����C($k�q�n���(.a,E��� � �exkG�{�çC���&"9��h=ߠu˶!�W�Y]��]�^}���M�����[�4s�sz�/��C� �|4R�V�W0L��&���">@��7�����R���a��S�g�o��!����0�H�A��+{~~����G��B����Dp!=�3��`�p�oħ.@3L��E�D�Iy�Q�u} �z�����ҵIT1n�}_��^؞̰���3�ؼ��� �v�~� Bӹ����Pi9<=�J1��zt�x˾&�Q5Ӈ�����N�>g^�/���r[��``��.8>|g�����L�y�Ƹ����m��y�)9�����L>�0>l�'F$!��?1Ym>*��R�*�4i4IS��\ � ~�,�e"�#�e�뤰A�f����7d.R^�\ϳԻK'�4v������^�+�=���EO�_�d�֟ �쟙�Ka"l���ه�0��o\�l;�RS����Wzĺ�B�I�g'LS s����C %������X't�Y!4}��ζ�ل��?Q���M9� � /�� �{W�v'H���{�]�B>�h���/�&�c�ދ%q�[<�P�G���4��&�+@7W0��VX(�:S�3�%�� ��!꽔?��G��?h�3��Ke1i�>w@�/�J�W��0ꇒ18c��0MGkP��@����O5�d�/�#�n�%��n�'�v������G��Y�:��gpM�d-Ә"jR�����o2�h�����5�����1B֪ ��n�xJ�]n�Σ�-�����jS/�� J����iL٬�d�����}�Ә��p�c��P��d������Jز�f�d��k�aJn�$�ʕ8G�N��kni����"u[�߁�47�̆����%�^Ex�"7��S��q�j�=mU c �G�e��X4u�y&�K�۽K�K��Y�A��]GT���� .z��ԟJ�S���Po�U���23Bw0�8K����ڮ��|4���#c�SǢ�:D�m����G)�W��甼�Y�Q4%���1*=O#��Ru)����_b_o'�ǯ��炗�7S;�S��H���������4��Q/�m��W����R��9�}ʝZ��=���g���}C���Au[@<��>k�^#�f���NaDe���m� G]�[&��e���z!�@T���Sz����yE��!��p�F�u�{�n�+b��I��ti�Ŗ��4�G�����q!��#v�p������7�:��UK��~ f����ۢ����H�!���5���#��iƆ�ѬF7> =_���+�������`r\�#�J;��$2߆0ʾ"�T:�ٌ�� R���!��+65�i��[ �%G�V�_���'�;�(�&y�s�3�*X�S1$�˾�g%@�q������d#�'�OQ��3��I�M^��C���t��t<7iT��g_a�wB������/\�����p�u������wlK�!F��ק�)Bs0oX\�p���{�������٣��<�0���[���K��0"�i�п�MJ0�S�cp �
Behavioral task
behavioral1
Sample
krampus.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
krampus.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
krampus.exe
Resource
macos-20240711.1-en
General
-
Target
krampus.exe
-
Size
5.6MB
-
MD5
e3f7cfc15aecea1f817fd9e1c91b2b33
-
SHA1
4427bc42173e964762c4f003628502ec601d45c0
-
SHA256
64706688105210a3c3d265aceb11475e38bc1f35ffcd72a8d38bacc0806653eb
-
SHA512
ed233e15a3d3947feb95c388355d7a8b05a06b2c74997b80dba331facf991f57ae252976a2465bec74c13075d06fa5cdc1930ee8e87da830e6bd1821f8eb2733
-
SSDEEP
98304:R4UGDPt5D8brm4+Bo4M4du9I0y1ZKnnyZhK9iYRiBSqXGijc/Elh:R4/PD8m4IAOsI0fyiwS/iYsh
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource krampus.exe
Files
-
krampus.exe.exe windows:6 windows x64 arch:x64
a89bdbb5ed415ad3d3ec6aed111c65bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetUserNameA
msvcp140
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
ntdll
RtlLookupFunctionEntry
urlmon
URLOpenBlockingStreamA
ws2_32
htons
mswsock
GetAcceptExSockaddrs
wininet
InternetOpenA
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-string-l1-1-0
iscntrl
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
round
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 386KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ