/t�~ABm���W���Rt���!"5������ �0mSǬ��%���w��퓆�,��%%�:����]�>�s���b���<�S�ae��a'������w5��m������ٴ�����W�>i��MЌ�q�&�"�{� 3�M {��A�� Yd�zK�-J�E����mv�f +"p0UA���ڻ�A|_?��.g�/�v��M3F��a��$�*5���n3�*P�/�F$8�������~k������]j�j�,i�z���_+|2�D�U���E1�(9�����Z���"��v�g|��$�3:-���b;(~P�̖��s~�e�jV����;��ԯy���=GP�����OU��Jƀ5�^5�{>������������jg �eRzA�^��^S�r�s�瑚�)�k��% ���T����%Yt~��������C���O.<�a�&:�D������Ȉ������>��/�M!m�5�N��Q���E:����*.G��_xL�e��J�%�-H�9W���[Uh�,�xvi�8�����1��L'\vfo�U7���2ʤJ&��s��g|gT�!t0��u��z츌MI�� �;?������[ֆ<�����T(T��G9w-`�����ql��>nG!�2 � a�j��o�(�{e/����<ƠU�����M��؈D�̪��)\�U�?S<����Mi�U� *Ȱsy����q�p��O���6f��� �X;��B�w�L�q�����Xe��w�ۊË�? ���p@Pǯ�?$m���nw��I@'ƨ��4�#п�q�Nb SA�T�<&��0�� �D8X��!�F=a%�JUt�آl��۷wCy��2�iH�ےD#���1����?|F�틏��j]��x�C��3��H�"�n'X���Uh=��w 5�]v�M,�j�㋜�&��ýYwr>�`Z��_h��sU�)�j�!kƫ�9�J'�"�rz�\�4Jt ;�?�_�ɪÒw',J�a��P:>�'쪒�k��������d =>��{H����� ��)_�P�q�8pK ���ҥQY'ZB�42�����.^�x�� k�#��o|� Ӂ��0 �ag���� �g� ֧��Bcf�Jo��Vk�����U��%�C1qK��)EY��YR��6_mZ=�<OI��O���p�`}f�|��2�)��82�w�}��p��e�#<��f�Г��2vr�x.���9+B�<� ��$��x�5���� 0���:�h2��<!�¬��|�3Y�--/�]M�0�q��{Ox�a�Q��=���^�Z��Ss{�"�d���Tl�= ��3%���|$a�%�g���Qm^ Eř����&�a����AD�4��DCy����wa�0�t�{ ��$ܵ�JI����^Iʥ����w�h��E:Ւr�4����������~��߀B������W!��P[�v�,߱�3����&�z��Y[�D��B�V�x��OLq�q���9��jS��� .�����P��e�A8��0L��`��esz~t�=� ��W�,�rd�N�����.V�mUY}�� d����F6��2�3�p�K�>o�Y��9�Y�2Jg�+̰#�p��U�/^\�v3�tL�0��������������c�"+���}�#�r��=��W!#��Qq�;�\gF.����`淐z�D�+E�h�[���+�����T������"����x��l�{ =�����f.��j�w��"0��װp�j�TS�xщ��v�$~�K .*��p%A#�A����C,���4h� ���,�<iU��z1�ߞH�*���j[ؽ G4�վNX��F���������W7�_l�a"�Ѣ�a9��"�̭�U�_�}�܌&5�u-��HF<�l��Av`��S8.嬞r���0��� AH���l�t����*������ipغ�[˪�ݢ� �7�۵vA��W?���Yae�#��*�'�l<�Wʗ��Nޡʼ7��Ǯ����0rk�-��>!c±E"XL���D|`�7?���_V���Ş(Ɓ��7��@�V��{�F*[���E�u����mB��sFB��If�%�m+��Pa�����[?^��I2����������淤��D;�gt��*���5� �I �W�����2�1�AʅX���đ;<�+S��s�Se� �c�����ǩj՚����I���f;�ϵ- #];�Q�3Ďh�Zb�����؞�б�YՇ�j � 0=]�0��;�/��<S}-N�ʼnc;GT�{W� ^a��9X�-�r"c�z���q��ڄ����s�d��'�[V�A�b��&�ڼ����bO5k���}W����b�J!��> ;W�B���g܀I�f&"����ud�:F�WJ����aX�q@�^��v;��||���nӏ�W��4/�i�0L&J���� n'2G�#<Z�@ �&r���φ�y�����!���������HN�'<�oi �] "�{gwo v��@�8�l]��EA��~v�� Bb�tM~f�Db�� � ��[WYP%�q\�'�������M���.���M�m�u�Dzh�6&��U -�r��1����ű��gp�f*����v��%u�����Iɏ��-�7p�^7I�M�$�Q�b;��K�i�eδ0@i~xK�Q��/}=�7����.��6�G��Rc|��l�H��`�W�eO�'���oM��4�HIe�:�he{r?{z���D�=�]���=S�t�� ��S'+�.\�����֜5#�������O1v6��Fq�g��� b��6($������i)����J!��4&�5kd�7�-AV�=�Ҭ�¤�T>�mvn�&>�j���!����X)e��l��\D+cqh4�i��dp�@/�A�.�F��.��<buQ����/'2� *��*�M���PE�$J������/�o� �Br���A��4됴�����N �V�٩�6��V(�I2ă���]�RPIӭV!^���)���au�b���������7,��V.�-N�K`5���e��7ޥ�A
General
-
Target
Karma.exe
-
Size
17.8MB
-
MD5
c7cdc36aa916c21f66150d399e92d40b
-
SHA1
32d2239a4a3cc2d3964a9500c6c8bfc3e57ada4a
-
SHA256
7b61415cdf55c6ff24eb2417af54c9b247743dd92603eb9a889561181e01a884
-
SHA512
f1f58f821169131e5cfd33c15baa73f1613d083932239aa90381113170f065cf54fbe9f312fabbc592670b846eeca7f844f60262b5896ad855f4e65226786515
-
SSDEEP
393216:1Nyz+pPwtWw6jSvBi/fhW1ribMgSS0fUMCnB0rF+GbW5KDcL:bg+pPw4w6jSvBli4PBrFtkKE
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Karma.exe
Files
-
Karma.exe.exe windows:6 windows x64 arch:x64
612e8afb77598c53323490687026d5f2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d10
D3D10CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
kernel32
GlobalFree
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetCurrentHwProfileA
ole32
CoInitializeSecurity
oleaut32
SysAllocString
imm32
ImmSetCandidateWindow
ws2_32
setsockopt
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 806KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: - Virtual size: 14.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 16.5MB - Virtual size: 16.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ