Behavioral task
behavioral1
Sample
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe
Resource
win10v2004-20230220-en
General
-
Target
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.zip
-
Size
485KB
-
MD5
a071fce53e2bf9fb9a2db5ce91c511ef
-
SHA1
addf8230e78fa84c8b9c1b3bac4162a82e6421b4
-
SHA256
7662313c95bb2e2cc6a34343d7375903bf079641a07886fc01c1547f198c1c04
-
SHA512
636e1382cccd782d594f4cc0dcf9d40fe34d0d1f6b2033c7395b665adda86a4f7f6ef6fca46da562982f0dc7480b1f8291dedd2a55b177c33ed171452ac47d00
-
SSDEEP
12288:1ALp9O2llZPJPgekZm+vCLHugohggZLCMGxyx:WrOklZPZgDm+vCLHuOgZLCJS
Malware Config
Signatures
-
Avaddon family
-
Avaddon payload 1 IoCs
resource yara_rule static1/unpack001/0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe family_avaddon
Files
-
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.zip.zip
Password: infected
-
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe.exe windows x86
Password: infected
84789fed28ecdb34d8ea466d9386a4ec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
WriteFile
CreateFileW
ReadFile
GetFileSizeEx
GetFileAttributesW
SetFileAttributesW
SetFilePointerEx
MoveFileExW
FindFirstFileW
FindNextFileW
GetEnvironmentVariableW
FindClose
GetShortPathNameA
ReleaseMutex
GetLocaleInfoA
GetDiskFreeSpaceA
GetComputerNameA
WriteConsoleW
SetEndOfFile
HeapSize
ReadConsoleW
GetProcessHeap
GetThreadContext
HeapAlloc
CloseHandle
Process32FirstW
GetCurrentThread
GetUserDefaultLCID
Process32NextW
GetLastError
Sleep
CreateToolhelp32Snapshot
OpenProcess
WaitForSingleObject
OpenMutexW
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
HeapFree
WideCharToMultiByte
MultiByteToWideChar
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
SetVolumeMountPointW
FindFirstVolumeW
QueryDosDeviceW
FlushFileBuffers
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapReAlloc
GetConsoleMode
GetConsoleCP
SetStdHandle
DeleteFileW
GetFileType
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetStdHandle
CopyFileW
CreateMutexW
ExitProcess
RtlUnwind
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualFree
GetLogicalDrives
CreateProcessW
VirtualProtect
VirtualAlloc
GetVersionExW
LoadLibraryExW
GetModuleHandleA
FreeLibraryAndExitThread
FreeLibrary
GetThreadTimes
RaiseException
GetCurrentThreadId
IsProcessorFeaturePresent
QueueUserWorkItem
GetModuleHandleExW
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
WaitForSingleObjectEx
EncodePointer
DecodePointer
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetEvent
ResetEvent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
LocalFree
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
user32
SystemParametersInfoW
GetKeyboardLayout
advapi32
EnumDependentServicesW
OpenServiceW
CryptSetKeyParam
CryptDestroyKey
CryptAcquireContextW
CryptEncrypt
CryptDuplicateKey
CryptExportKey
CryptImportKey
CryptGenKey
CryptReleaseContext
OpenProcessToken
GetTokenInformation
RegCloseKey
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
RegSetValueExW
StartServiceW
RegOpenKeyExW
RegCreateKeyW
QueryServiceStatusEx
shell32
SHGetSpecialFolderPathA
SHEmptyRecycleBinW
ole32
CoInitializeEx
IIDFromString
CLSIDFromString
CoGetObject
CoSetProxyBlanket
CoInitializeSecurity
CoCreateInstance
CoUninitialize
oleaut32
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantInit
VariantClear
SysStringByteLen
mpr
WNetGetConnectionA
WNetGetConnectionW
netapi32
NetApiBufferFree
NetShareEnum
iphlpapi
SendARP
ws2_32
gethostbyname
WSAStartup
gethostname
inet_ntoa
WSACleanup
inet_addr
rstrtmgr
RmShutdown
RmRegisterResources
RmStartSession
RmEndSession
RmGetList
crypt32
CryptStringToBinaryA
wininet
InternetReadFile
HttpOpenRequestW
InternetOpenW
HttpSendRequestW
HttpSendRequestA
InternetConnectW
InternetCloseHandle
Sections
.text Size: 609KB - Virtual size: 608KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 425KB - Virtual size: 424KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 38KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ