privateloader | 2024-05-11_32db5eef10eb341f56e6c873cd84250c_avoslocker_metamorfo_revil

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-11_32db5eef10eb341f56e6c873cd84250c_avoslocker_metamorfo_revil
Size 21.3MB
Sample240511-mpkqsaff49
SHA256 0ae85cb5d33a5205740a5d0513a13519a2ac27ec7eccb606d8f651770b906575
MD5 32db5eef10eb341f56e6c873cd84250c
SHA1 f7b7361a243dde6c33ddef570eb86ac5b38dc4c1
SHA512 5de7e56c422cce6c170744df9f9fe008df39ffd45712ad7b6dfb4b98f5d4a401a7a87570beec3202ec9251045a80b7daa0b48dcdac7f2b606eef26324e0c0b2d
SSDEEP 196608:XCfsQRc4Zkr+K6SHULTHpFnsVufrqNsaUQGXXXCS1gJynzv:XFUarEJhsofrqN1/GXXT1P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader

Malware Config

Signatures

Privateloader family
privateloader

File Explorer

2024-05-11_32db5eef10eb341f56e6c873cd84250c_avoslocker_metamorfo_revil

.exe 21.3MB

2024-05-11_32db5eef10eb341f56e6c873cd84250c_avoslocker_metamorfo_revil

IMPHASH 65a603fdc32eed194c86af51cc334e46
SHA256 0ae85cb5d33a5205740a5d0513a13519a2ac27ec7eccb606d8f651770b906575
MD5 32db5eef10eb341f56e6c873cd84250c
SHA1 f7b7361a243dde6c33ddef570eb86ac5b38dc4c1
SHA512 5de7e56c422cce6c170744df9f9fe008df39ffd45712ad7b6dfb4b98f5d4a401a7a87570beec3202ec9251045a80b7daa0b48dcdac7f2b606eef26324e0c0b2d
SSDEEP 196608:XCfsQRc4Zkr+K6SHULTHpFnsVufrqNsaUQGXXXCS1gJynzv:XFUarEJhsofrqN1/GXXT1P
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

83:90:e1:cc:df:44:ce:b3:e1:a3:b9:d4:5e:ca:57:ab:09:25:25:4d:a3:08:93:a2:77:82:47:fa:ff:29:47:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=727035-6,CN=Avanquest Software (7270356 Canada Inc),O=Avanquest Software (7270356 Canada Inc),L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Chains

May 9, 2024

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2021 - Dec 29, 2040

Subject

Serial Number

41:20:3f:a4:7b:99:d3:12:6f:05:65:21:05:71:57:86

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 16, 2022 - Sep 16, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4721727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TemporaryBuilds\azure-installer-pool-de-1\14\s\_bin\suite2021\Win32\PDFSuite2021Installer.pdb

kernel32

CloseHandle HeapAlloc GetProcessHeap HeapFree CreateEventA SetEvent CreateDirectoryW RemoveDirectoryW WaitForSingleObjectEx GetCurrentThreadId GetCurrentProcess LocalAlloc LocalFree GetDriveTypeW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetCommandLineW GetLastError RaiseException GetModuleHandleW GetProcAddress DecodePointer InitializeCriticalSectionAndSpinCount InterlockedDecrement CreateThread WaitForSingleObject CreateEventW GetCurrentProcessId MultiByteToWideChar WideCharToMultiByte CreateFileW GetModuleFileNameW GetFileSize ReadFile HeapDestroy HeapReAlloc HeapSize TerminateProcess OutputDebugStringW SetUnhandledExceptionFilter InterlockedExchange GetDiskFreeSpaceExW GetLogicalDriveStringsW FindResourceW LoadResource LockResource SizeofResource DeleteFileW SetFileAttributesW GetFullPathNameW GetVersionExW WriteFile CopyFileW CreateProcessW FindFirstFileW FindNextFileW FindClose Sleep CreateMutexW ReleaseMutex LoadLibraryW FreeLibrary ReleaseSemaphore CreateSemaphoreA WaitForMultipleObjectsEx InterlockedIncrement lstrcmpiW LoadLibraryExW QueryPerformanceCounter QueryPerformanceFrequency CreateMutexA GetUserDefaultLCID OpenProcess CreateToolhelp32Snapshot Module32FirstW Module32NextW IsWow64Process GetExitCodeProcess Process32FirstW Process32NextW GetModuleHandleA BeginUpdateResourceW UpdateResourceW EndUpdateResourceW GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetModuleFileNameA LoadLibraryExA FormatMessageW SetLastError DuplicateHandle TlsAlloc WaitForMultipleObjects TerminateThread QueueUserAPC InterlockedExchangeAdd PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus InterlockedCompareExchange VerSetConditionMask VerifyVersionInfoW ProcessIdToSessionId TlsGetValue TlsSetValue TlsFree GetSystemInfo GetTickCount GetStdHandle OutputDebugStringA GetTempPathA GetWindowsDirectoryA GetComputerNameA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetSystemTimeAsFileTime SetFilePointer SetFileTime SystemTimeToFileTime LocalFileTimeToFileTime GetCurrentDirectoryW GetFileAttributesW lstrcpynW SwitchToThread UnmapViewOfFile CreateFileMappingA FormatMessageA GlobalSize LoadLibraryA GetTempFileNameA GetLocaleInfoA FindResourceA MulDiv ExitThread GetCPInfo SetThreadLocale GetNumberFormatW GetCurrencyFormatW GetSystemTime GetLocalTime GetTimeZoneInformation FileTimeToSystemTime GetLocaleInfoW GetDateFormatW GetThreadLocale GetVersionExA SetEndOfFile MapViewOfFile FlushViewOfFile CompareStringW GetTempPathW SleepEx GetSystemDirectoryA VerifyVersionInfoA ExpandEnvironmentStringsA GetFileType PeekNamedPipe GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetModuleHandleExW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetCurrentThread GetThreadTimes UnregisterWaitEx VirtualProtect VirtualQuery GetWindowsDirectoryW GetFileAttributesExW ResetEvent UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetStringTypeW GetExitCodeThread TryEnterCriticalSection QueueUserWorkItem EncodePointer LCMapStringW OpenEventA ResumeThread CreateWaitableTimerA SetFilePointerEx DeviceIoControl AreFileApisANSI GetStringTypeExW LCMapStringA GetStringTypeExA IsValidCodePage IsDBCSLeadByteEx EnumSystemLocalesA FoldStringW GetTimeFormatW CreateProcessA RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetConsoleCtrlHandler VirtualAlloc WriteConsoleW GetConsoleCP ExitProcess SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread GetACP IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle CreatePipe FindFirstFileExW GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait VirtualFree InterlockedPopEntrySList QueryDepthSList GetStringTypeA

??0?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@QAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ ??0?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ ??1?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ ??1?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtagRECT@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ ?get_lock@singleton_module@serialization@boost@@CAAA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@SA_NXZ ?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@CAAA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@SAXXZ ?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?unlock@singleton_module@serialization@boost@@SAXXZ

generic

count=45, id=241, version=40116,

count=208, id=243, version=40116,

count=36, id=242, version=40116,

count=70, id=261, productName=VS2017 v15.6.6 build 26131, version=26131,

count=10, id=199, version=41118,

count=40, id=260, version=26706,

count=29, id=259, version=26706,

count=146, id=261, version=26706,

count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=23, productName=Unmarked objects (old),

count=721, id=260, productName=VS2017 v15.7.3 build 26430, version=26430,

count=746, id=1, productName=Unmarked objects,

count=211, id=261, productName=VS2017 v15.7.3 build 26430, version=26430,

count=3, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=162, id=264, version=27049,

count=1, id=256, version=27049,

count=1, id=255, version=27049,

count=1, id=151,

count=1, id=258, version=27049,