2024-05-16_5e248ac89e47c5f59967962c2d46c7bd_avoslocker

Sharing

Copy URL

Twitter E-mail

General

Target

2024-05-16_5e248ac89e47c5f59967962c2d46c7bd_avoslocker
Size

7.4MB
MD5

5e248ac89e47c5f59967962c2d46c7bd
SHA1

a77586144fabfb4d114258309ae2e90a29f14f17
SHA256

4f48cbf847ee57145b28ee5aed993f43ac079286a168f943245cfe0595feb302
SHA512

d4b88e381b4f77bcd0528ee04f1ed2f54c02884c09eac5a6b96d00ba05682c936b3e9d1493d748eda8c22cfb3cc7a58adb6c3442abbd89c6729b5e895d19ddef
SSDEEP

196608:Ig1zKJfNffJHYVM0fotzMmHkeb6soBso+:lzKJlfJEMAo8eb6k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-16_5e248ac89e47c5f59967962c2d46c7bd_avoslocker

Files

2024-05-16_5e248ac89e47c5f59967962c2d46c7bd_avoslocker
.exe windows:6 windows x86 arch:x86

aceca47dd37a920a32f73901ee90a9db

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dbghelp

SymInitialize
SymFromAddr
SymGetLineFromAddr64

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
RegDeleteValueW
RegEnumValueW
RegEnumKeyW
CryptAcquireContextA
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
SystemFunction036

ws2_32

recv
closesocket
send
WSAGetLastError
gethostname
WSACleanup
gethostbyname
WSAStartup
bind
WSASend
WSADuplicateSocketW
shutdown
WSARecvFrom
WSARecv
WSASocketW
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect

shell32

CommandLineToArgvW
ShellExecuteA

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptStringToBinaryA
CertFindCertificateInStore
CertOpenStore
PFXIsPFXBlob
PFXImportCertStore
CertGetCertificateContextProperty
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore

kernel32

GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
SetThreadAffinityMask
GetThreadPriority
GetThreadTimes
SignalObjectAndWait
CreateTimerQueue
GetLogicalProcessorInformation
InitializeSListHead
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
FreeLibraryAndExitThread
VirtualProtect
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
RtlUnwind
SystemTimeToTzSpecificLocalTime
ExitThread
ExitProcess
GetCommandLineA
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
SetThreadPriority
GetStdHandle
GetFileSizeEx
GetFileType
ReadFile
WriteFile
GetLastError
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetConsoleCP
GetConsoleMode
ReadConsoleW
WriteConsoleW
FlushConsoleInputBuffer
SetStdHandle
CreateFileW
GetFileAttributesW
GetFileSize
SetFileAttributesW
CloseHandle
DuplicateHandle
SetLastError
GetCurrentProcess
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameW
LocalFree
FormatMessageA
MoveFileExW
GetConsoleScreenBufferInfo
GetFileAttributesExW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetOEMCP
GetCPInfoExW
IsDBCSLeadByteEx
GetVersionExW
IsWow64Process
LockFileEx
UnlockFileEx
CreatePipe
GetConsoleOutputCP
FormatMessageW
GetFileTime
SetFileTime
GetVolumeInformationA
GetSystemDirectoryA
GetWindowsDirectoryA
ExpandEnvironmentStringsW
CompareFileTime
DeleteFileW
FindClose
FindFirstFileW
GetFileInformationByHandle
GetFullPathNameW
GetShortPathNameW
RemoveDirectoryW
DeviceIoControl
Sleep
GetModuleHandleW
GetProcAddress
GetCommandLineW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetHandleInformation
InitializeCriticalSection
GetTimeZoneInformation
LeaveCriticalSection
ReleaseSemaphore
WaitForSingleObject
WaitForMultipleObjects
CreateSemaphoreW
TerminateProcess
GetExitCodeProcess
CreateThread
ResumeThread
CreateProcessW
OpenProcess
SetConsoleCtrlHandler
GenerateConsoleCtrlEvent
SetConsoleTextAttribute
FreeLibrary
LoadLibraryExW
RtlCaptureStackBackTrace
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalMemoryStatusEx
GetSystemInfo
LoadLibraryW
lstrcmpiW
CreateDirectoryW
SetEndOfFile
SetFilePointer
LoadLibraryA
GetTempPathW
FindNextFileW
GetDiskFreeSpaceW
GetDriveTypeW
GetVolumePathNameW
GetOverlappedResult
HeapReAlloc
ResetEvent
CreateEventW
VirtualAlloc
VirtualFree
IsValidCodePage
CreateFileA
GetFileAttributesA
PeekNamedPipe
SearchPathA
SetHandleInformation
CreateProcessA
SleepEx
GetModuleHandleA
GetTickCount
MoveFileExA
GetEnvironmentVariableA
VerSetConditionMask
VerifyVersionInfoA
FlushFileBuffers
GetFinalPathNameByHandleW
SetFilePointerEx
FlushViewOfFile
CreateFileMappingA
ReOpenFile
CopyFileW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
SetErrorMode
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
CancelIoEx
CancelSynchronousIo
DeleteCriticalSection
CreateEventA
SwitchToThread
GetCurrentThread
QueueUserWorkItem
CreateNamedPipeA
GetNamedPipeHandleStateA
RegisterWaitForSingleObject
UnregisterWait
GetStartupInfoW
DebugBreak
SetEvent
SetConsoleMode
GetNumberOfConsoleInputEvents
ReadConsoleInputW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
SetConsoleCursorPosition
WriteConsoleInputW
GetEnvironmentVariableW
UnregisterWaitEx
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
GetProcessAffinityMask
SetProcessAffinityMask
LCMapStringW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
FileTimeToSystemTime
CreateToolhelp32Snapshot
Process32First
Process32Next
TryEnterCriticalSection
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableCS
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateSemaphoreA
GetLongPathNameW
ReadDirectoryChangesW
SetFileCompletionNotificationModes
GetProcessHeap
GetStringTypeW
GetLocaleInfoW
CompareStringW
DecodePointer
EncodePointer
InitializeCriticalSectionAndSpinCount
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AreFileApisANSI
FindFirstFileExW
GetExitCodeThread
HeapSize
EnumSystemLocalesW
GetCurrentThreadId
RaiseException
GetModuleHandleExW
WaitForSingleObjectEx
EnterCriticalSection
CancelIo
IsProcessorFeaturePresent

user32

DispatchMessageA
CharPrevExA
WaitForInputIdle
GetMessageA
TranslateMessage
MapVirtualKeyW
GetSystemMetrics

ole32

CoCreateInstance
GetRunningObjectTable
CreateBindCtx
CoInitialize
CoTaskMemFree
CoInitializeEx
CoUninitialize

oleaut32

SysAllocString
SafeArrayDestroy
SysFreeString
VariantInit
VariantClear

Sections

.text
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 955KB - Virtual size: 955KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 94KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aceca47dd37a920a32f73901ee90a9db

Headers

DLL Characteristics

File Characteristics

Imports

dbghelp

advapi32

ws2_32

shell32

crypt32

kernel32

user32

ole32

oleaut32

Sections

.text Size: 6.1MB - Virtual size: 6.1MB

.rdata Size: 955KB - Virtual size: 955KB

.data Size: 94KB - Virtual size: 2.6MB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 244KB - Virtual size: 244KB

.text
Size: 6.1MB - Virtual size: 6.1MB

.rdata
Size: 955KB - Virtual size: 955KB

.data
Size: 94KB - Virtual size: 2.6MB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 244KB - Virtual size: 244KB