privateloader | 2024-05-10_3c0d5ab9180f2ea139d9296678956bc2_avoslocker_metamorfo_revil

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-10_3c0d5ab9180f2ea139d9296678956bc2_avoslocker_metamorfo_revil
Size 21.3MB
Sample240510-me5cface64
SHA256 f76d3b15cc70fa35b8508e4c33924d8eb7a62b9cf16226d576ecdc0332b23325
MD5 3c0d5ab9180f2ea139d9296678956bc2
SHA1 b963928a6518c7ab5f193fbb386a9c1b9f788b78
SHA512 25b39dbaf6a0869cb8a5872e5079103c95b0d90f9aef2b9ce8ab9c16cc5e69fc5f85ca1c7eb92d4d471b90667d8b1468964ca5f1f0bf566fb3538061cbac8051
SSDEEP 196608:KCfsQRc4Zkr+K6SHULTHpFnsVufrqNVaUQGXaXCS1gJylzI:KFUarEJhsofrqN0/GXaT16
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader

Malware Config

Signatures

Privateloader family
privateloader

File Explorer

2024-05-10_3c0d5ab9180f2ea139d9296678956bc2_avoslocker_metamorfo_revil

.exe 21.3MB

2024-05-10_3c0d5ab9180f2ea139d9296678956bc2_avoslocker_metamorfo_revil

IMPHASH 65a603fdc32eed194c86af51cc334e46
SHA256 f76d3b15cc70fa35b8508e4c33924d8eb7a62b9cf16226d576ecdc0332b23325
MD5 3c0d5ab9180f2ea139d9296678956bc2
SHA1 b963928a6518c7ab5f193fbb386a9c1b9f788b78
SHA512 25b39dbaf6a0869cb8a5872e5079103c95b0d90f9aef2b9ce8ab9c16cc5e69fc5f85ca1c7eb92d4d471b90667d8b1468964ca5f1f0bf566fb3538061cbac8051
SSDEEP 196608:KCfsQRc4Zkr+K6SHULTHpFnsVufrqNVaUQGXaXCS1gJylzI:KFUarEJhsofrqN0/GXaT16
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

d1:a1:ef:e4:e2:f1:dc:a7:ba:2b:75:a4:c0:ea:ec:3e:09:ba:29:1a:f3:11:25:95:fd:22:ee:f6:12:f3:1b:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=727035-6,CN=Avanquest Software (7270356 Canada Inc),O=Avanquest Software (7270356 Canada Inc),L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Chains

May 8, 2024

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2021 - Dec 29, 2040

Subject

Serial Number

41:20:3f:a4:7b:99:d3:12:6f:05:65:21:05:71:57:86

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 16, 2022 - Sep 16, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4721727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TemporaryBuilds\azure-installer-pool-de-1\14\s\_bin\suite2021\Win32\PDFSuite2021Installer.pdb

kernel32

CloseHandle HeapAlloc GetProcessHeap HeapFree CreateEventA SetEvent CreateDirectoryW RemoveDirectoryW WaitForSingleObjectEx GetCurrentThreadId GetCurrentProcess LocalAlloc LocalFree GetDriveTypeW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetCommandLineW GetLastError RaiseException GetModuleHandleW GetProcAddress DecodePointer InitializeCriticalSectionAndSpinCount InterlockedDecrement CreateThread WaitForSingleObject CreateEventW GetCurrentProcessId MultiByteToWideChar WideCharToMultiByte CreateFileW GetModuleFileNameW GetFileSize ReadFile HeapDestroy HeapReAlloc HeapSize TerminateProcess OutputDebugStringW SetUnhandledExceptionFilter InterlockedExchange GetDiskFreeSpaceExW GetLogicalDriveStringsW FindResourceW LoadResource LockResource SizeofResource DeleteFileW SetFileAttributesW GetFullPathNameW GetVersionExW WriteFile CopyFileW CreateProcessW FindFirstFileW FindNextFileW FindClose Sleep CreateMutexW ReleaseMutex LoadLibraryW FreeLibrary ReleaseSemaphore CreateSemaphoreA WaitForMultipleObjectsEx InterlockedIncrement lstrcmpiW LoadLibraryExW QueryPerformanceCounter QueryPerformanceFrequency CreateMutexA GetUserDefaultLCID OpenProcess CreateToolhelp32Snapshot Module32FirstW Module32NextW IsWow64Process GetExitCodeProcess Process32FirstW Process32NextW GetModuleHandleA BeginUpdateResourceW UpdateResourceW EndUpdateResourceW GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetModuleFileNameA LoadLibraryExA FormatMessageW SetLastError DuplicateHandle TlsAlloc WaitForMultipleObjects TerminateThread QueueUserAPC InterlockedExchangeAdd PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus InterlockedCompareExchange VerSetConditionMask VerifyVersionInfoW ProcessIdToSessionId TlsGetValue TlsSetValue TlsFree GetSystemInfo GetTickCount GetStdHandle OutputDebugStringA GetTempPathA GetWindowsDirectoryA GetComputerNameA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetSystemTimeAsFileTime SetFilePointer SetFileTime SystemTimeToFileTime LocalFileTimeToFileTime GetCurrentDirectoryW GetFileAttributesW lstrcpynW SwitchToThread UnmapViewOfFile CreateFileMappingA FormatMessageA GlobalSize LoadLibraryA GetTempFileNameA GetLocaleInfoA FindResourceA MulDiv ExitThread GetCPInfo SetThreadLocale GetNumberFormatW GetCurrencyFormatW GetSystemTime GetLocalTime GetTimeZoneInformation FileTimeToSystemTime GetLocaleInfoW GetDateFormatW GetThreadLocale GetVersionExA SetEndOfFile MapViewOfFile FlushViewOfFile CompareStringW GetTempPathW SleepEx GetSystemDirectoryA VerifyVersionInfoA ExpandEnvironmentStringsA GetFileType PeekNamedPipe GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetModuleHandleExW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetCurrentThread GetThreadTimes UnregisterWaitEx VirtualProtect VirtualQuery GetWindowsDirectoryW GetFileAttributesExW ResetEvent UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetStringTypeW GetExitCodeThread TryEnterCriticalSection QueueUserWorkItem EncodePointer LCMapStringW OpenEventA ResumeThread CreateWaitableTimerA SetFilePointerEx DeviceIoControl AreFileApisANSI GetStringTypeExW LCMapStringA GetStringTypeExA IsValidCodePage IsDBCSLeadByteEx EnumSystemLocalesA FoldStringW GetTimeFormatW CreateProcessA RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetConsoleCtrlHandler VirtualAlloc WriteConsoleW GetConsoleCP ExitProcess SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread GetACP IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle CreatePipe FindFirstFileExW GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait VirtualFree InterlockedPopEntrySList QueryDepthSList GetStringTypeA

??0?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@QAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ ??0?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ ??1?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ ??1?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtagRECT@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ ?get_lock@singleton_module@serialization@boost@@CAAA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@SA_NXZ ?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@CAAA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@SAXXZ ?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?unlock@singleton_module@serialization@boost@@SAXXZ

generic

count=45, id=241, version=40116,

count=208, id=243, version=40116,

count=36, id=242, version=40116,

count=70, id=261, productName=VS2017 v15.6.6 build 26131, version=26131,

count=10, id=199, version=41118,

count=40, id=260, version=26706,

count=29, id=259, version=26706,

count=146, id=261, version=26706,

count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=23, productName=Unmarked objects (old),

count=721, id=260, productName=VS2017 v15.7.3 build 26430, version=26430,

count=746, id=1, productName=Unmarked objects,

count=211, id=261, productName=VS2017 v15.7.3 build 26430, version=26430,

count=3, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=162, id=264, version=27049,

count=1, id=256, version=27049,

count=1, id=255, version=27049,

count=1, id=151,

count=1, id=258, version=27049,