privateloader | 2024-05-12_4e7385bbd3a86fd36c39f46c89f29685_avoslocker_metamorfo_revil

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-12_4e7385bbd3a86fd36c39f46c89f29685_avoslocker_metamorfo_revil
Size 21.3MB
Sample240512-msfagabf4v
SHA256 797ed125db386b361284597322587957e58861f0d3a0a7a76f3853448cb92a07
MD5 4e7385bbd3a86fd36c39f46c89f29685
SHA1 8095f9060a91c55e15212c1f91c04fd6970d6e8e
SHA512 db1e867d77497da13db3286eec9cd68b7d4cf93f6a76b796045a5104ce238f7f2bfbe2f71945240e21eff0ccfbfc475a44ff74500cff17cf0b99c73a7feb79f7
SSDEEP 196608:GCfsQRc4Zkr+K6SHULTHpFnsVufrqNeaUQGXYXCS1gJyiz9:GFUarEJhsofrqNT/GXYT1c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader

Malware Config

Signatures

Privateloader family
privateloader

File Explorer

2024-05-12_4e7385bbd3a86fd36c39f46c89f29685_avoslocker_metamorfo_revil

.exe 21.3MB

2024-05-12_4e7385bbd3a86fd36c39f46c89f29685_avoslocker_metamorfo_revil

IMPHASH 65a603fdc32eed194c86af51cc334e46
SHA256 797ed125db386b361284597322587957e58861f0d3a0a7a76f3853448cb92a07
MD5 4e7385bbd3a86fd36c39f46c89f29685
SHA1 8095f9060a91c55e15212c1f91c04fd6970d6e8e
SHA512 db1e867d77497da13db3286eec9cd68b7d4cf93f6a76b796045a5104ce238f7f2bfbe2f71945240e21eff0ccfbfc475a44ff74500cff17cf0b99c73a7feb79f7
SSDEEP 196608:GCfsQRc4Zkr+K6SHULTHpFnsVufrqNeaUQGXYXCS1gJyiz9:GFUarEJhsofrqNT/GXYT1c
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

e3:2b:80:bb:11:6a:66:c1:9b:cb:2f:66:ce:26:f2:b5:ac:19:3d:04:1e:4b:55:52:0b:67:38:6f:69:e5:e1:0f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=727035-6,CN=Avanquest Software (7270356 Canada Inc),O=Avanquest Software (7270356 Canada Inc),L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Chains

May 10, 2024

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2021 - Dec 29, 2040

Subject

Serial Number

41:20:3f:a4:7b:99:d3:12:6f:05:65:21:05:71:57:86

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 16, 2022 - Sep 16, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4721727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TemporaryBuilds\azure-installer-pool-de-1\14\s\_bin\suite2021\Win32\PDFSuite2021Installer.pdb

kernel32

CloseHandle HeapAlloc GetProcessHeap HeapFree CreateEventA SetEvent CreateDirectoryW RemoveDirectoryW WaitForSingleObjectEx GetCurrentThreadId GetCurrentProcess LocalAlloc LocalFree GetDriveTypeW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetCommandLineW GetLastError RaiseException GetModuleHandleW GetProcAddress DecodePointer InitializeCriticalSectionAndSpinCount InterlockedDecrement CreateThread WaitForSingleObject CreateEventW GetCurrentProcessId MultiByteToWideChar WideCharToMultiByte CreateFileW GetModuleFileNameW GetFileSize ReadFile HeapDestroy HeapReAlloc HeapSize TerminateProcess OutputDebugStringW SetUnhandledExceptionFilter InterlockedExchange GetDiskFreeSpaceExW GetLogicalDriveStringsW FindResourceW LoadResource LockResource SizeofResource DeleteFileW SetFileAttributesW GetFullPathNameW GetVersionExW WriteFile CopyFileW CreateProcessW FindFirstFileW FindNextFileW FindClose Sleep CreateMutexW ReleaseMutex LoadLibraryW FreeLibrary ReleaseSemaphore CreateSemaphoreA WaitForMultipleObjectsEx InterlockedIncrement lstrcmpiW LoadLibraryExW QueryPerformanceCounter QueryPerformanceFrequency CreateMutexA GetUserDefaultLCID OpenProcess CreateToolhelp32Snapshot Module32FirstW Module32NextW IsWow64Process GetExitCodeProcess Process32FirstW Process32NextW GetModuleHandleA BeginUpdateResourceW UpdateResourceW EndUpdateResourceW GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetModuleFileNameA LoadLibraryExA FormatMessageW SetLastError DuplicateHandle TlsAlloc WaitForMultipleObjects TerminateThread QueueUserAPC InterlockedExchangeAdd PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus InterlockedCompareExchange VerSetConditionMask VerifyVersionInfoW ProcessIdToSessionId TlsGetValue TlsSetValue TlsFree GetSystemInfo GetTickCount GetStdHandle OutputDebugStringA GetTempPathA GetWindowsDirectoryA GetComputerNameA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetSystemTimeAsFileTime SetFilePointer SetFileTime SystemTimeToFileTime LocalFileTimeToFileTime GetCurrentDirectoryW GetFileAttributesW lstrcpynW SwitchToThread UnmapViewOfFile CreateFileMappingA FormatMessageA GlobalSize LoadLibraryA GetTempFileNameA GetLocaleInfoA FindResourceA MulDiv ExitThread GetCPInfo SetThreadLocale GetNumberFormatW GetCurrencyFormatW GetSystemTime GetLocalTime GetTimeZoneInformation FileTimeToSystemTime GetLocaleInfoW GetDateFormatW GetThreadLocale GetVersionExA SetEndOfFile MapViewOfFile FlushViewOfFile CompareStringW GetTempPathW SleepEx GetSystemDirectoryA VerifyVersionInfoA ExpandEnvironmentStringsA GetFileType PeekNamedPipe GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetModuleHandleExW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetCurrentThread GetThreadTimes UnregisterWaitEx VirtualProtect VirtualQuery GetWindowsDirectoryW GetFileAttributesExW ResetEvent UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetStringTypeW GetExitCodeThread TryEnterCriticalSection QueueUserWorkItem EncodePointer LCMapStringW OpenEventA ResumeThread CreateWaitableTimerA SetFilePointerEx DeviceIoControl AreFileApisANSI GetStringTypeExW LCMapStringA GetStringTypeExA IsValidCodePage IsDBCSLeadByteEx EnumSystemLocalesA FoldStringW GetTimeFormatW CreateProcessA RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetConsoleCtrlHandler VirtualAlloc WriteConsoleW GetConsoleCP ExitProcess SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread GetACP IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle CreatePipe FindFirstFileExW GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait VirtualFree InterlockedPopEntrySList QueryDepthSList GetStringTypeA

??0?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@QAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ ??0?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ ??1?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ ??1?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtagRECT@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ ?get_lock@singleton_module@serialization@boost@@CAAA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@SA_NXZ ?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@CAAA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@SAXXZ ?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?unlock@singleton_module@serialization@boost@@SAXXZ

generic

count=45, id=241, version=40116,

count=208, id=243, version=40116,

count=36, id=242, version=40116,

count=70, id=261, productName=VS2017 v15.6.6 build 26131, version=26131,

count=10, id=199, version=41118,

count=40, id=260, version=26706,

count=29, id=259, version=26706,

count=146, id=261, version=26706,

count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=23, productName=Unmarked objects (old),

count=721, id=260, productName=VS2017 v15.7.3 build 26430, version=26430,

count=746, id=1, productName=Unmarked objects,

count=211, id=261, productName=VS2017 v15.7.3 build 26430, version=26430,

count=3, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=162, id=264, version=27049,

count=1, id=256, version=27049,

count=1, id=255, version=27049,

count=1, id=151,

count=1, id=258, version=27049,