privateloader | 2024-05-12_2c8852c7d5528529dfbfa74534ec6556_avoslocker_metamorfo_revil

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-12_2c8852c7d5528529dfbfa74534ec6556_avoslocker_metamorfo_revil
Size 21.3MB
Sample240512-mnpncabe4w
SHA256 1af9346e6c36c419cb712a1326fa968cc3e4692994a09857d23f288a350749fb
MD5 2c8852c7d5528529dfbfa74534ec6556
SHA1 9cf5ceea87916b3aae59aabb5d5ed37d0cf83737
SHA512 7a7dba67d1220a924e1944391d1002b935dd8647037929750e396048b5b3a5e6ca30127b630bde2029e0cb08587ea93882aa69734df9e3cdf461471d24ae3528
SSDEEP 196608:jCfsQRc4Zkr+K6SHULTHpFnsVufrqNPaUQGX9XCS1gJyxzs:jFUarEJhsofrqNy/GX9T1S
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader

Malware Config

Signatures

Privateloader family
privateloader

File Explorer

2024-05-12_2c8852c7d5528529dfbfa74534ec6556_avoslocker_metamorfo_revil

.exe 21.3MB

2024-05-12_2c8852c7d5528529dfbfa74534ec6556_avoslocker_metamorfo_revil

IMPHASH 65a603fdc32eed194c86af51cc334e46
SHA256 1af9346e6c36c419cb712a1326fa968cc3e4692994a09857d23f288a350749fb
MD5 2c8852c7d5528529dfbfa74534ec6556
SHA1 9cf5ceea87916b3aae59aabb5d5ed37d0cf83737
SHA512 7a7dba67d1220a924e1944391d1002b935dd8647037929750e396048b5b3a5e6ca30127b630bde2029e0cb08587ea93882aa69734df9e3cdf461471d24ae3528
SSDEEP 196608:jCfsQRc4Zkr+K6SHULTHpFnsVufrqNPaUQGX9XCS1gJyxzs:jFUarEJhsofrqNy/GX9T1S
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

31:ea:0e:fa:8e:61:12:9f:f8:dd:d5:b9:fd:f7:1e:54:93:9b:f1:af:11:87:74:22:ff:02:03:ee:1e:94:7b:8c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=727035-6,CN=Avanquest Software (7270356 Canada Inc),O=Avanquest Software (7270356 Canada Inc),L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Chains

May 11, 2024

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2021 - Dec 29, 2040

Subject

Serial Number

41:20:3f:a4:7b:99:d3:12:6f:05:65:21:05:71:57:86

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 16, 2022 - Sep 16, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4721727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TemporaryBuilds\azure-installer-pool-de-1\14\s\_bin\suite2021\Win32\PDFSuite2021Installer.pdb

kernel32

CloseHandle HeapAlloc GetProcessHeap HeapFree CreateEventA SetEvent CreateDirectoryW RemoveDirectoryW WaitForSingleObjectEx GetCurrentThreadId GetCurrentProcess LocalAlloc LocalFree GetDriveTypeW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetCommandLineW GetLastError RaiseException GetModuleHandleW GetProcAddress DecodePointer InitializeCriticalSectionAndSpinCount InterlockedDecrement CreateThread WaitForSingleObject CreateEventW GetCurrentProcessId MultiByteToWideChar WideCharToMultiByte CreateFileW GetModuleFileNameW GetFileSize ReadFile HeapDestroy HeapReAlloc HeapSize TerminateProcess OutputDebugStringW SetUnhandledExceptionFilter InterlockedExchange GetDiskFreeSpaceExW GetLogicalDriveStringsW FindResourceW LoadResource LockResource SizeofResource DeleteFileW SetFileAttributesW GetFullPathNameW GetVersionExW WriteFile CopyFileW CreateProcessW FindFirstFileW FindNextFileW FindClose Sleep CreateMutexW ReleaseMutex LoadLibraryW FreeLibrary ReleaseSemaphore CreateSemaphoreA WaitForMultipleObjectsEx InterlockedIncrement lstrcmpiW LoadLibraryExW QueryPerformanceCounter QueryPerformanceFrequency CreateMutexA GetUserDefaultLCID OpenProcess CreateToolhelp32Snapshot Module32FirstW Module32NextW IsWow64Process GetExitCodeProcess Process32FirstW Process32NextW GetModuleHandleA BeginUpdateResourceW UpdateResourceW EndUpdateResourceW GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetModuleFileNameA LoadLibraryExA FormatMessageW SetLastError DuplicateHandle TlsAlloc WaitForMultipleObjects TerminateThread QueueUserAPC InterlockedExchangeAdd PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus InterlockedCompareExchange VerSetConditionMask VerifyVersionInfoW ProcessIdToSessionId TlsGetValue TlsSetValue TlsFree GetSystemInfo GetTickCount GetStdHandle OutputDebugStringA GetTempPathA GetWindowsDirectoryA GetComputerNameA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetSystemTimeAsFileTime SetFilePointer SetFileTime SystemTimeToFileTime LocalFileTimeToFileTime GetCurrentDirectoryW GetFileAttributesW lstrcpynW SwitchToThread UnmapViewOfFile CreateFileMappingA FormatMessageA GlobalSize LoadLibraryA GetTempFileNameA GetLocaleInfoA FindResourceA MulDiv ExitThread GetCPInfo SetThreadLocale GetNumberFormatW GetCurrencyFormatW GetSystemTime GetLocalTime GetTimeZoneInformation FileTimeToSystemTime GetLocaleInfoW GetDateFormatW GetThreadLocale GetVersionExA SetEndOfFile MapViewOfFile FlushViewOfFile CompareStringW GetTempPathW SleepEx GetSystemDirectoryA VerifyVersionInfoA ExpandEnvironmentStringsA GetFileType PeekNamedPipe GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetModuleHandleExW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetCurrentThread GetThreadTimes UnregisterWaitEx VirtualProtect VirtualQuery GetWindowsDirectoryW GetFileAttributesExW ResetEvent UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetStringTypeW GetExitCodeThread TryEnterCriticalSection QueueUserWorkItem EncodePointer LCMapStringW OpenEventA ResumeThread CreateWaitableTimerA SetFilePointerEx DeviceIoControl AreFileApisANSI GetStringTypeExW LCMapStringA GetStringTypeExA IsValidCodePage IsDBCSLeadByteEx EnumSystemLocalesA FoldStringW GetTimeFormatW CreateProcessA RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetConsoleCtrlHandler VirtualAlloc WriteConsoleW GetConsoleCP ExitProcess SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread GetACP IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle CreatePipe FindFirstFileExW GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait VirtualFree InterlockedPopEntrySList QueryDepthSList GetStringTypeA

??0?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@QAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ ??0?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ ??1?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ ??1?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtagRECT@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ ?get_lock@singleton_module@serialization@boost@@CAAA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@SA_NXZ ?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@CAAA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@SAXXZ ?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?unlock@singleton_module@serialization@boost@@SAXXZ

generic

count=45, id=241, version=40116,

count=208, id=243, version=40116,

count=36, id=242, version=40116,

count=70, id=261, productName=VS2017 v15.6.6 build 26131, version=26131,

count=10, id=199, version=41118,

count=40, id=260, version=26706,

count=29, id=259, version=26706,

count=146, id=261, version=26706,

count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=23, productName=Unmarked objects (old),

count=721, id=260, productName=VS2017 v15.7.3 build 26430, version=26430,

count=746, id=1, productName=Unmarked objects,

count=211, id=261, productName=VS2017 v15.7.3 build 26430, version=26430,

count=3, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=162, id=264, version=27049,

count=1, id=256, version=27049,

count=1, id=255, version=27049,

count=1, id=151,

count=1, id=258, version=27049,