2024-05-02_d3123095136d31fd4a1a97ed90e1dc2d_avoslocker_revil

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-02_d3123095136d31fd4a1a97ed90e1dc2d_avoslocker_revil
Size

7.8MB
MD5

d3123095136d31fd4a1a97ed90e1dc2d
SHA1

f7789e10461b178e766b268bc6dd80922e634dee
SHA256

87fa2d19e2370678188d4bf3eaab45598db68d3009cfc2a4d5e89340dc489659
SHA512

6945aec62ecf01b27ccdd3305a34213f912b11463bbcdceda3027a68ab2a7722c522eea135289bc6cc3052e9ebad0c61fb8225a60bdedffdee92d39dca0376ee
SSDEEP

98304:pGix4K0lmZNgGTpE7SerwFAHjnmG07IRKQX9goORuJE5gLYC/OJ976yOPwlbBMNp:seZeCeVmG07MxfH/Q6yOC22cB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-02_d3123095136d31fd4a1a97ed90e1dc2d_avoslocker_revil

Files

2024-05-02_d3123095136d31fd4a1a97ed90e1dc2d_avoslocker_revil
.exe windows:6 windows x86 arch:x86

1d9fc1f0afc2b27828b460bfd382ad8c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalUnlock
MulDiv
FreeResource
GetTickCount
GetUserDefaultLCID
FreeLibrary
CreateDirectoryW
GetCommandLineW
GetCurrentProcess
TerminateProcess
CreatePipe
PeekNamedPipe
OpenProcess
GetFileAttributesExW
GlobalFlags
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateProcessW
CopyFileW
VirtualQuery
GenerateConsoleCtrlEvent
GetExitCodeProcess
SetLocalTime
FileTimeToSystemTime
GetLocalTime
GetSystemTimeAsFileTime
lstrcmpiW
LoadLibraryExW
VerSetConditionMask
VerifyVersionInfoW
CreateFileA
DeleteFileA
InitializeCriticalSectionAndSpinCount
HeapSize
GetLastError
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
GetDateFormatW
GetTimeFormatW
InitializeCriticalSection
EnterCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
DeleteFileW
Sleep
FindFirstFileW
FindClose
GetFileAttributesW
SetFileAttributesW
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetEndOfFile
GetFullPathNameW
SetStdHandle
FlushFileBuffers
GetFileSizeEx
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetConsoleOutputCP
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
SetConsoleCtrlHandler
FreeLibraryAndExitThread
ExitThread
GetCommandLineA
GetModuleHandleExW
RtlUnwind
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
LCMapStringEx
InitializeCriticalSectionEx
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
GetModuleHandleA
CompareFileTime
CreateFileMappingA
MapViewOfFile
GetEnvironmentVariableA
MoveFileExW
QueryPerformanceFrequency
SleepEx
SystemTimeToFileTime
GetSystemTime
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
GetEnvironmentVariableW
ConvertThreadToFiber
ConvertFiberToThread
QueryPerformanceCounter
FormatMessageW
CreateFiber
DeleteFiber
SwitchToFiber
GetFileType
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
FindNextFileW
RemoveDirectoryW
LoadLibraryW
MoveFileW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetModuleFileNameW
HeapFree
CloseHandle
CreateFileW
SetFilePointer
SetFilePointerEx
ReadFile
GlobalFree
GlobalAlloc
WaitForMultipleObjects
MapViewOfFileEx
CreateFileMappingW
GetFileSize
UnmapViewOfFile
CreateIoCompletionPort
ResetEvent
GetSystemInfo
GetExitCodeThread
PostQueuedCompletionStatus
GetQueuedCompletionStatus
FindResourceW
LoadResource
FindResourceExW
LockResource
SizeofResource
GetNativeSystemInfo
CreateSemaphoreW
SwitchToThread
ReleaseSemaphore
GetCurrentProcessId
SetLastError
HeapCreate
GetProcAddress
GetSystemDirectoryW
Process32NextW
Process32FirstW
QueryDosDeviceW
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
OutputDebugStringW
GetLogicalDriveStringsW
GetCurrentThreadId
GlobalLock
GetModuleHandleW
IsDebuggerPresent
CreateEventW
ResumeThread
CreateThread
WaitForSingleObject
SetEvent
WriteFile

user32

UnregisterClassW
GetWindowRect
MoveWindow
SetCapture
ReleaseCapture
IsZoomed
GetTopWindow
DestroyIcon
WindowFromPoint
ScreenToClient
MessageBeep
OffsetRect
RedrawWindow
ClientToScreen
SetParent
PtInRect
SendMessageW
PostMessageW
DestroyWindow
GetCursorPos
DrawTextW
SetRect
MessageBoxW
GetWindowLongW
SetWindowPos
SetWindowLongW
InvalidateRect
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
ShowWindow
FindWindowA
SendMessageA
GetUserObjectInformationW
GetProcessWindowStation
EnableWindow
GetFocus
IsWindow
SetFocus
GetKeyState
SetCursor
AdjustWindowRectEx
GetWindowThreadProcessId
FindWindowExA
IsWindowEnabled
MsgWaitForMultipleObjects
ReleaseDC
GetClientRect
GetWindowDC
GetSystemMetrics
GetDC
LoadImageW
GetParent
GetDesktopWindow
LoadCursorW
LoadIconW
RegisterClassW
GetClassInfoW
GetActiveWindow
LoadStringW
CreateWindowExW
EnumWindows
GetMonitorInfoW
WaitForInputIdle
SetActiveWindow
MonitorFromWindow
wsprintfW
GetClassInfoExW
GetSysColor
RegisterClassExW
IsWindowVisible
CallWindowProcW
CharNextW
CreateMenu
PostQuitMessage
AppendMenuW
TranslateAcceleratorW
DestroyMenu
GetSystemMenu
CreateAcceleratorTableW
DestroyAcceleratorTable
GetSubMenu
TrackPopupMenu
CreatePopupMenu
DeleteMenu
GetDlgItem
FillRect
EndPaint
GetNextDlgTabItem
BeginPaint
IsIconic
GetClassNameW
IntersectRect
IsRectEmpty
WinHelpW
SetMenu
IsChild
GetDlgCtrlID
IsDialogMessageW
DrawIcon
SetWindowRgn
GetWindow
GetLastActivePopup

gdi32

CreateRectRgn
CombineRgn
SetBkMode
GetTextMetricsW
ExcludeClipRect
GetClipBox
CreateRoundRectRgn
CreateEllipticRgn
SetTextColor
SetBkColor
CreateSolidBrush
CreateFontIndirectW
SelectObject
CreateDIBSection
SetDIBColorTable
CreateCompatibleDC
GdiAlphaBlend
GetStockObject
GetDeviceCaps
DeleteDC
GetObjectW
SetStretchBltMode
DeleteObject

advapi32

ReportEventW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegEnumKeyExW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegisterEventSourceW
DeregisterEventSource
RegDeleteKeyW
RegQueryInfoKeyW

shell32

DragQueryFileW
DragFinish
ShellExecuteW
Shell_NotifyIconW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CreateStreamOnHGlobal
CoCreateInstance
CoInitializeEx
CoUninitialize

oleaut32

VarUI4FromStr
VarUdateFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime

comctl32

ImageList_Create
ImageList_AddMasked
InitCommonControlsEx
ImageList_Destroy
ImageList_GetImageCount
ImageList_SetBkColor

psapi

GetProcessImageFileNameW

shlwapi

StrPBrkW
StrChrW

wldap32

ord208
ord41
ord117
ord26
ord27
ord216
ord167
ord142
ord79
ord133
ord147
ord301
ord14
ord46
ord219
ord145
ord127

ws2_32

WSAGetLastError
ntohs
htons
sendto
closesocket
setsockopt
freeaddrinfo
gethostname
select
__WSAFDIsSet
accept
getnameinfo
recvfrom
listen
WSACloseEvent
WSACreateEvent
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
recv
WSAEnumNetworkEvents
WSACleanup
bind
WSAStartup
socket
connect
WSAGetOverlappedResult
WSAIoctl
WSASend
ntohl
shutdown
WSASetLastError
WSAStringToAddressW
getaddrinfo
getpeername
getsockname
send
WSAAddressToStringW
WSARecv
getsockopt
htonl
ioctlsocket

uxtheme

SetWindowTheme

winmm

timeGetTime
timeEndPeriod
timeGetDevCaps
timeBeginPeriod

gdiplus

GdipCreateBitmapFromFile
GdipGetImageWidth
GdipSetCompositingMode
GdipGetImagePalette
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipBitmapLockBits
GdipFree
GdipGetImagePixelFormat
GdipDisposeImage
GdipDrawImageRectI
GdipAlloc
GdipCreateBitmapFromStream
GdipBitmapUnlockBits
GdipCloneImage
GdipGetImagePaletteSize
GdipGetImageHeight
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromScan0

bcrypt

BCryptGenRandom

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1d9fc1f0afc2b27828b460bfd382ad8c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

psapi

shlwapi

wldap32

ws2_32

uxtheme

winmm

gdiplus

bcrypt

crypt32

Sections

.text Size: 2.9MB - Virtual size: 2.9MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 32KB - Virtual size: 52KB

.rsrc Size: 3.5MB - Virtual size: 3.5MB

.reloc Size: 173KB - Virtual size: 172KB

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 32KB - Virtual size: 52KB

.rsrc
Size: 3.5MB - Virtual size: 3.5MB

.reloc
Size: 173KB - Virtual size: 172KB