2024-04-28_6cd575ac91239312e6a68fceefcb08c7_avoslocker_metamorfo_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-04-28_6cd575ac91239312e6a68fceefcb08c7_avoslocker_metamorfo_revil
Size

6.3MB
MD5

6cd575ac91239312e6a68fceefcb08c7
SHA1

ce88732bc9ae805519a9d2e82764a41dbcc87280
SHA256

21c761ab28a41c1cdd6ad41c69ef2a82f4ec0dd806677a890a2f46e9927de9b2
SHA512

2d741002575d11b38feba52a9d13c5d9c4e99e056acbdbfc6f0544e4fb53d9ac71b2b0999b6f3c872112ef5482cb008cb9384850813079f3b74602c6e0380cd2
SSDEEP

98304:Or4vSgnI97O/ugNGP0LkTA/ur/PPpgRtPUG/JqFemhKuOtgOqIB/CYoc3tDtJYJe:+DggwuA/y/PSuG/mM0O3Vs4LAiPj+y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-04-28_6cd575ac91239312e6a68fceefcb08c7_avoslocker_metamorfo_revil

Files

2024-04-28_6cd575ac91239312e6a68fceefcb08c7_avoslocker_metamorfo_revil
.exe windows:5 windows x86 arch:x86

7fff94f94fcb8872cefe053d295280c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

CreateCompatibleBitmap
GdiFlush
SelectClipRgn
CreateRectRgn
BitBlt
CreateBitmap
CreateCompatibleDC
SelectPalette
CreateDCA
GetObjectA
CreateDIBitmap
DeleteObject
GetTextMetricsA
GetGlyphOutlineW
GetFontData
GetCharABCWidthsW
GetCharABCWidthsA
GetCharWidthW
EnumFontFamiliesW
CreateFontW
ExtTextOutW
Polyline
Polygon
MoveToEx
PolyPolyline
SetTextColor
SetROP2
SetBkColor
ExtSelectClipRgn
RectVisible
PolyPolygon
PatBlt
LineTo
GetTextColor
GetCurrentObject
GetClipRgn
GetBkColor
GetROP2
Ellipse
CreateRectRgnIndirect
CreatePatternBrush
Arc
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
LPtoDP
AbortDoc
EndPage
StartPage
EndDoc
StartDocW
SetTextAlign
SetMapMode
SetBkMode
GetViewportOrgEx
GetStockObject
GetNearestColor
CreateSolidBrush
CreatePen
CreatePalette
CreateICA
StretchDIBits
CreateDIBSection
SetDIBitsToDevice
SelectObject
GetDIBits
GetDeviceCaps
DeleteDC
RealizePalette

comdlg32

PrintDlgA

user32

IsWindowUnicode
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
AdjustWindowRect
AdjustWindowRectEx
MessageBeep
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
GetWindowLongA
GetMessageA
TranslateMessage
DispatchMessageW
PeekMessageA
PeekMessageW
UnregisterHotKey
PostMessageA
PostThreadMessageA
PostQuitMessage
RegisterClassA
RegisterClassW
CreateWindowExA
DestroyWindow
ShowWindow
MoveWindow
SetWindowPos
IsWindowVisible
GetActiveWindow
GetCapture
SetCapture
ReleaseCapture
GetKeyboardLayout
SetTimer
GetFocus
UpdateWindow
GetForegroundWindow
SetForegroundWindow
GetUpdateRgn
ValidateRect
ScrollWindow
GetClientRect
GetWindowRect
MessageBoxA
SetWindowLongA
GetParent
GetWindow
LoadCursorA
DestroyCursor
GetCaretBlinkTime
SendMessageA
FlashWindowEx
IsIconic
IsZoomed
SetWindowTextW
LoadIconA
LoadImageA
CreateIconIndirect
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
RegisterClipboardFormatA
EmptyClipboard
IsClipboardFormatAvailable
SystemParametersInfoW
SystemParametersInfoA
GetSysColor
GetDoubleClickTime
SetFocus
GetWindowPlacement
DefWindowProcW
GetIconInfo
GetKeyState
DefWindowProcA
GetMessageExtraInfo
DrawIconEx
DestroyIcon
GetSystemMetrics
GetProcessWindowStation
GetUserObjectInformationW
MsgWaitForMultipleObjects
MessageBoxW
GetClipboardFormatNameA

kernel32

ReadConsoleA
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetProcAddress
LoadLibraryA
DeleteFileA
GetStdHandle
FindFirstFileExW
FindNextFileW
GetFullPathNameW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
AllocConsole
FreeConsole
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
CloseHandle
CreateThread
GlobalUnlock
GlobalLock
GlobalFree
GetLocaleInfoA
WaitForSingleObject
GetCurrentThreadId
GetModuleHandleA
GlobalAlloc
GlobalSize
LoadLibraryW
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
GetEnvironmentVariableW
HeapSize
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
SetConsoleCtrlHandler
ReadConsoleW
GetFileSizeEx
FlushFileBuffers
EnumSystemLocalesW
IsValidLocale
LCMapStringW
CompareStringW
HeapReAlloc
HeapAlloc
HeapFree
FreeLibraryAndExitThread
ExitThread
GetConsoleOutputCP
GetFileType
SetStdHandle
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetLastError
InterlockedPushEntrySList
RtlUnwind
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleW
GetSystemTimeAsFileTime
GetCPInfo
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
RaiseException
QueryPerformanceFrequency
QueryPerformanceCounter
SetFilePointerEx
GetFileInformationByHandle
GetStringTypeW
GetProcessAffinityMask
GlobalMemoryStatusEx
SetEvent
GetCurrentProcess
GetUserDefaultLCID
OutputDebugStringA
GetModuleFileNameA
CreateFileW
GetFileSize
ReadFile
SetEndOfFile
SetFilePointer
WriteFile
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindFirstFileW
GetDriveTypeW
GetVolumeInformationW
MoveFileW
SystemTimeToFileTime
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LocalFree
GetTickCount
FormatMessageA
GetConsoleMode
SetConsoleMode
SetConsoleOutputCP
PeekNamedPipe
ReleaseSemaphore
CreateEventA
SetThreadPriority
GetExitCodeThread
CreateSemaphoreA
VirtualAlloc
VirtualFree
GetLocaleInfoW
GetSystemTime
GetLocalTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetVersionExA
GetModuleFileNameW
IsBadReadPtr
CreateFileA
SetUnhandledExceptionFilter

ole32

CoTaskMemFree
CoCreateGuid
DoDragDrop
RevokeDragDrop
CoUninitialize
ReleaseStgMedium
RegisterDragDrop
CoSetProxyBlanket
CoCreateInstance
CoInitialize
OleInitialize
OleUninitialize
CoInitializeEx
CoInitializeSecurity

oleaut32

SysAllocString
VariantClear
SysFreeString

shell32

CommandLineToArgvW
ShellExecuteW
SHGetFolderPathW
SHGetFileInfoW

winmm

PlaySoundA
timeBeginPeriod

usp10

ScriptGetFontProperties
ScriptGetGlyphABCWidth
ScriptShape
ScriptFreeCache
ScriptItemize

advapi32

RegOpenKeyExA
RegQueryValueExA
GetUserNameA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey

imm32

ImmGetCompositionStringW
ImmReleaseContext
ImmNotifyIME
ImmSetCandidateWindow
ImmAssociateContextEx
ImmGetOpenStatus
ImmGetCompositionStringA
ImmGetContext

ws2_32

WSACleanup
WSASetLastError
closesocket
connect
ioctlsocket
recv
select
send
socket
WSAStartup
WSAGetLastError
getaddrinfo
freeaddrinfo

mpr

WNetEnumResourceW
WNetOpenEnumA
WNetCloseEnum

bcrypt

BCryptGenRandom

Exports

Exports

pcre_assign_jit_stack
pcre_callout
pcre_compile
pcre_compile2
pcre_config
pcre_copy_named_substring
pcre_copy_substring
pcre_dfa_exec
pcre_exec
pcre_free
pcre_free_study
pcre_free_substring
pcre_free_substring_list
pcre_fullinfo
pcre_get_named_substring
pcre_get_stringnumber
pcre_get_stringtable_entries
pcre_get_substring
pcre_get_substring_list
pcre_jit_free_unused_memory
pcre_jit_stack_alloc
pcre_jit_stack_free
pcre_maketables
pcre_malloc
pcre_pattern_to_host_byte_order
pcre_refcount
pcre_stack_free
pcre_stack_guard
pcre_stack_malloc
pcre_study
pcre_version

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 250KB - Virtual size: 4.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fff94f94fcb8872cefe053d295280c0

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

comdlg32

user32

kernel32

ole32

oleaut32

shell32

winmm

usp10

advapi32

imm32

ws2_32

mpr

bcrypt

Exports

Exports

Sections

.text Size: 4.6MB - Virtual size: 4.6MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 250KB - Virtual size: 4.8MB

.reloc Size: 232KB - Virtual size: 232KB

.text
Size: 4.6MB - Virtual size: 4.6MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 250KB - Virtual size: 4.8MB

.reloc
Size: 232KB - Virtual size: 232KB