Static task
static1
Behavioral task
behavioral1
Sample
2024-05-15_6e8df4a062e1f6e4ebc762c5e16f7f64_avoslocker_revil.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-15_6e8df4a062e1f6e4ebc762c5e16f7f64_avoslocker_revil.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-15_6e8df4a062e1f6e4ebc762c5e16f7f64_avoslocker_revil
-
Size
2.0MB
-
MD5
6e8df4a062e1f6e4ebc762c5e16f7f64
-
SHA1
cabf7f5747e87bfaadcae84f8f9bbcbad57ae273
-
SHA256
c4495c14180aee3f2276def358eb465ebceaf30a3e8a836603c425995c69e8c7
-
SHA512
8b40e78321655d35f3a8969a51c80b7065be2d273504fce19a77c0e8fe8e99e77f140a470fe873501343a12e24f76348e05de12c2fc085a8d0247e88efd1085a
-
SSDEEP
49152:HtwjVEIgAaKbKZmfol4FCPr9Xqw4mM0GUl:HtwOIJwmfol209X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-05-15_6e8df4a062e1f6e4ebc762c5e16f7f64_avoslocker_revil
Files
-
2024-05-15_6e8df4a062e1f6e4ebc762c5e16f7f64_avoslocker_revil.exe windows:6 windows x86 arch:x86
54d0a8ecf2ae9930c2536439a8f62cb3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
recv
send
socket
setsockopt
connect
freeaddrinfo
getsockopt
ioctlsocket
getnameinfo
ntohs
shutdown
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
inet_ntop
closesocket
WSASocketW
getaddrinfo
WSAConnect
crypt32
CertGetCertificateContextProperty
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertOpenStore
CertCloseStore
kernel32
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetStartupInfoW
ReadFile
WriteFile
TerminateProcess
CreatePipe
PeekNamedPipe
GetEnvironmentVariableA
Sleep
CloseHandle
CreateProcessW
MultiByteToWideChar
WideCharToMultiByte
WinExec
GetDriveTypeA
GetVolumeInformationA
GetNativeSystemInfo
GetLogicalDriveStringsA
GlobalMemoryStatusEx
GetDiskFreeSpaceExA
GetComputerNameA
SetLastError
GetLastError
GetSystemTime
SystemTimeToFileTime
GetUserDefaultLCID
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToFiber
DeleteFiber
CreateFiber
GetModuleHandleExW
FindClose
FindFirstFileW
FindNextFileW
FormatMessageW
GetStdHandle
GetEnvironmentVariableW
GetFileType
GetModuleHandleW
GetProcAddress
ConvertFiberToThread
ConvertThreadToFiber
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
LoadLibraryW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
HeapAlloc
HeapFree
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
HeapReAlloc
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
SetEndOfFile
WriteConsoleW
EnterCriticalSection
SetFilePointerEx
GetFileSizeEx
GetCommandLineW
GetCommandLineA
GetModuleFileNameW
SetConsoleCtrlHandler
FileTimeToSystemTime
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
WaitForSingleObjectEx
GetExitCodeThread
QueryPerformanceFrequency
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
RtlUnwind
RaiseException
LoadLibraryExW
ExitProcess
CreateThread
ExitThread
FreeLibraryAndExitThread
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
user32
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
advapi32
CryptSignHashW
CryptEnumProvidersW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegCloseKey
GetUserNameA
RegOpenKeyExW
RegQueryValueExW
shell32
ShellExecuteExW
netapi32
NetApiBufferFree
NetUserEnum
bcrypt
BCryptGenRandom
Sections
.text Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 453KB - Virtual size: 452KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ