2024-05-17_4beda40842b7a494ea305fa2ac59fd9d_avoslocker

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-17_4beda40842b7a494ea305fa2ac59fd9d_avoslocker
Size

4.5MB
MD5

4beda40842b7a494ea305fa2ac59fd9d
SHA1

567fc805ecf42030d375ee20175061838c4a6032
SHA256

9a1d3618f0f718d4d1c46dd622fb444448678ae882803c18864357f349d2c419
SHA512

576d564de7aae2dfc761df039b0f638fd24353a70fbd9e4a6d59acb3963691554f1636148525ca429bd8c78f595ebef84e6252d8e05f512cbbd78259ba879a0f
SSDEEP

98304:ELnsPAtMWV7PwyLSSJQvWUCLtb8LpyIK/tJY4SKLfBzosr:EjsYjN9UCxqk17Y4SKb

Score

1^/10

Malware Config

Signatures

Files

2024-05-17_4beda40842b7a494ea305fa2ac59fd9d_avoslocker
.exe windows:6 windows x86 arch:x86

243791299897c13fe7d50dafd2aeea9d

Code Sign

23:f5:5c:00:bf:22:4e:4a
Certificate

Issuer

CN=RD Code Signing CA,OU=RSOS

Not Before

15/10/2022, 08:35

Not After

15/10/2023, 08:35

Subject

CN=RSOS DEV Open Sign,OU=RSOS Team,O=RSOS Team,C=CN

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
ExtKeyUsageIPSECEndSystem
ExtKeyUsageIPSECTunnel
ExtKeyUsageIPSECUser

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment
KeyUsageKeyAgreement

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:07:e4:34:d0:50:44:74
Certificate

Issuer

CN=RSOS Root CA,OU=RSOS

Not Before

15/10/2022, 08:28

Not After

15/10/2032, 08:28

Subject

CN=RD Code Signing CA,OU=RSOS

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageDataEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:f5:5c:00:bf:22:4e:4a
Certificate

Issuer

CN=RD Code Signing CA,OU=RSOS

Not Before

15/10/2022, 08:35

Not After

15/10/2023, 08:35

Subject

CN=RSOS DEV Open Sign,OU=RSOS Team,O=RSOS Team,C=CN

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
ExtKeyUsageIPSECEndSystem
ExtKeyUsageIPSECTunnel
ExtKeyUsageIPSECUser

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageKeyEncipherment
KeyUsageDataEncipherment
KeyUsageKeyAgreement

7d:07:e4:34:d0:50:44:74
Certificate

Issuer

CN=RSOS Root CA,OU=RSOS

Not Before

15/10/2022, 08:28

Not After

15/10/2032, 08:28

Subject

CN=RD Code Signing CA,OU=RSOS

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment
KeyUsageDataEncipherment
KeyUsageKeyAgreement
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

be:0b:4e:b0:ee:36:18:31:7a:17:78:3d:82:0d:c1:39:60:6c:7f:2a:6d:7a:6b:30:2b:0e:94:0d:4c:75:c1:74
Signer

Actual PE Digest

be:0b:4e:b0:ee:36:18:31:7a:17:78:3d:82:0d:c1:39:60:6c:7f:2a:6d:7a:6b:30:2b:0e:94:0d:4c:75:c1:74

Digest Algorithm

sha256

PE Digest Matches

true

3c:8f:3e:7e:7e:e0:63:14:ea:eb:26:c1:0a:b3:72:44:c3:a1:2e:f3
Signer

Actual PE Digest

3c:8f:3e:7e:7e:e0:63:14:ea:eb:26:c1:0a:b3:72:44:c3:a1:2e:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Programming\WinProjects\JiYuTrainer\Release\JiYuTrainer.pdb

Imports

iphlpapi

SendARP
GetExtendedTcpTable

ws2_32

accept
listen
recvfrom
getaddrinfo
freeaddrinfo
ioctlsocket
__WSAFDIsSet
select
bind
gethostname
WSASetLastError
getpeername
getsockname
connect
getsockopt
send
recv
WSAGetLastError
InetPtonW
WSAIoctl
htons
socket
setsockopt
WSAAddressToStringW
GetAddrInfoW
WSACleanup
WSAStartup
ntohs
closesocket
sendto

comctl32

InitCommonControlsEx

dbghelp

MiniDumpWriteDump

shlwapi

PathFileExistsW
SHDeleteKeyW
PathRenameExtensionW
PathRemoveFileSpecW

kernel32

GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
GetTempPathW
CreateDirectoryW
CopyFileW
LoadLibraryW
DeleteFileW
Sleep
TerminateProcess
FindResourceW
LoadResource
LockResource
SizeofResource
WriteFile
SetFileAttributesW
CreateMutexW
DebugBreak
LocalFree
GetModuleFileNameW
GetCommandLineW
ExitProcess
CreateThread
DeviceIoControl
OutputDebugStringW
SetLastError
FreeLibrary
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
HeapFree
lstrlenW
GetPrivateProfileStringW
WritePrivateProfileStringW
WideCharToMultiByte
MultiByteToWideChar
FormatMessageW
GlobalAlloc
GlobalLock
GlobalFree
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
VirtualFreeEx
GetFileType
SetFilePointer
ReadFile
SystemTimeToFileTime
CreateFileW
DosDateTimeToFileTime
SetFileTime
FileTimeToSystemTime
GetFileInformationByHandle
FindNextFileW
FindClose
GlobalAddAtomW
lstrcpyW
TerminateThread
FormatMessageA
VerSetConditionMask
SleepEx
VerifyVersionInfoW
InitializeCriticalSectionEx
GetTickCount64
ExpandEnvironmentStringsA
GetStdHandle
WaitForMultipleObjects
PeekNamedPipe
WaitForSingleObjectEx
ReadConsoleW
GetConsoleMode
GetTimeZoneInformation
FreeLibraryAndExitThread
ExitThread
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
SetFilePointerEx
GetModuleHandleExW
LoadLibraryExW
RaiseException
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
DecodePointer
EncodePointer
GetStringTypeW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CloseHandle
GetLastError
LeaveCriticalSection
EnterCriticalSection
WriteConsoleW
DeleteCriticalSection
InitializeCriticalSection
GetConsoleCP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetFileSizeEx
FlushFileBuffers
SetStdHandle
GetFullPathNameW
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetEndOfFile
HeapSize
GetLocalTime
GetCurrentDirectoryW

user32

GetMessageW
SetMenuItemBitmaps
LoadBitmapW
GetSubMenu
LoadMenuW
RegisterWindowMessageW
RegisterHotKey
ExitWindowsEx
TrackPopupMenu
DispatchMessageW
PostQuitMessage
UnregisterHotKey
RegisterClassExW
LoadCursorW
UpdateWindow
GetDesktopWindow
GetWindow
CallNextHookEx
GetWindowRect
DestroyWindow
PostMessageW
DialogBoxParamW
EnableWindow
GetDlgItemTextW
CheckDlgButton
CreateDialogParamW
GetClientRect
MoveWindow
CreateWindowExW
SetDlgItemTextA
TranslateMessage
GetCursorPos
MessageBoxW
MessageBoxTimeoutW
FindWindowW
IsWindowVisible
ShowWindow
IsIconic
SetForegroundWindow
GetAsyncKeyState
SendMessageW
LoadIconW
SetDlgItemTextW
IsDlgButtonChecked
EndDialog
DefWindowProcW
SendDlgItemMessageW
GetDlgItem
SendMessageTimeoutW
wsprintfW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
SetWindowsHookExW
CloseDesktop
GetWindowLongW
UnhookWindowsHookEx
OpenDesktopW
GetSystemMetrics
SetTimer
KillTimer
MessageBoxIndirectW
EnumDesktopWindows
GetWindowTextW
GetWindowThreadProcessId
SetWindowPos
SetWindowLongW

gdi32

SetTextColor
SetBkColor
DeleteObject
GetStockObject
CreateFontW

comdlg32

GetOpenFileNameW

advapi32

RegQueryValueExW
CryptDestroyKey
CryptAcquireContextW
CryptEncrypt
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptImportKey
CryptGetHashParam
OpenSCManagerW
CreateServiceW
CloseServiceHandle
OpenServiceW
StartServiceW
ControlService
DeleteService
RegOpenKeyExW
LookupPrivilegeValueW
CryptReleaseContext
GetTokenInformation
RegCloseKey
OpenProcessToken
AdjustTokenPrivileges

shell32

CommandLineToArgvW
Shell_NotifyIconW
ShellExecuteW

ntdll

RtlUnwind

wininet

InternetGetConnectedState

wldap32

ord118
ord216
ord142
ord41
ord14
ord79
ord145
ord26
ord127
ord46
ord301
ord133
ord208
ord167
ord27
ord147

Sections

.text
Size: 495KB - Virtual size: 494KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

243791299897c13fe7d50dafd2aeea9d

Code Sign

23:f5:5c:00:bf:22:4e:4aCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

7d:07:e4:34:d0:50:44:74Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

23:f5:5c:00:bf:22:4e:4aCertificate

Extended Key Usages

Key Usages

7d:07:e4:34:d0:50:44:74Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

be:0b:4e:b0:ee:36:18:31:7a:17:78:3d:82:0d:c1:39:60:6c:7f:2a:6d:7a:6b:30:2b:0e:94:0d:4c:75:c1:74Signer

3c:8f:3e:7e:7e:e0:63:14:ea:eb:26:c1:0a:b3:72:44:c3:a1:2e:f3Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

iphlpapi

ws2_32

comctl32

dbghelp

shlwapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ntdll

wininet

wldap32

Sections

.text Size: 495KB - Virtual size: 494KB

.rdata Size: 137KB - Virtual size: 137KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 3.8MB - Virtual size: 3.8MB

.reloc Size: 25KB - Virtual size: 25KB

23:f5:5c:00:bf:22:4e:4a
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

7d:07:e4:34:d0:50:44:74
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

23:f5:5c:00:bf:22:4e:4a
Certificate

7d:07:e4:34:d0:50:44:74
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

be:0b:4e:b0:ee:36:18:31:7a:17:78:3d:82:0d:c1:39:60:6c:7f:2a:6d:7a:6b:30:2b:0e:94:0d:4c:75:c1:74
Signer

3c:8f:3e:7e:7e:e0:63:14:ea:eb:26:c1:0a:b3:72:44:c3:a1:2e:f3
Signer

.text
Size: 495KB - Virtual size: 494KB

.rdata
Size: 137KB - Virtual size: 137KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 3.8MB - Virtual size: 3.8MB

.reloc
Size: 25KB - Virtual size: 25KB