General

Malware Config

Signatures

Files

• 2024-05-22_1c3eaac718c34a1fff1ee5b1fb27e442_avoslocker_cobalt-strike

  .exe windows:6 windows x86 arch:x86

  004c0ae6d5516ac4d444a59fb6e0c751

  
  

  Code Sign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  45:2d:ba:a0:52:13:f6:ea:e3:56:65:03:d3:5c:05:ad

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  28-03-2023 00:00

  Not After

  27-03-2026 23:59

  Subject

  CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  45:2d:ba:a0:52:13:f6:ea:e3:56:65:03:d3:5c:05:ad

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  28-03-2023 00:00

  Not After

  27-03-2026 23:59

  Subject

  CN=Bandisoft International Inc.,O=Bandisoft International Inc.,ST=Seoul,C=KR

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:86:e2:9e:51:a5:be:42:26:2a:89:6d:58:ee:d5:47:ca:32:ae:76:35:c3:5e:1a:b9:a8:91:d5:16:11:de:dc

  Signer

  Actual PE Digest

  07:86:e2:9e:51:a5:be:42:26:2a:89:6d:58:ee:d5:47:ca:32:ae:76:35:c3:5e:1a:b9:a8:91:d5:16:11:de:dc

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  9f:31:6d:2e:34:72:9c:14:aa:59:e6:eb:8d:d0:33:9c:9d:4c:64:d5

  Signer

  Actual PE Digest

  9f:31:6d:2e:34:72:9c:14:aa:59:e6:eb:8d:d0:33:9c:9d:4c:64:d5

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  D:\majosiaff.pdb

  Imports

  advapi32

  RegCloseKey

  RegOpenKeyA

  RegQueryValueExA

  GetUserNameA

  EqualSid

  AllocateAndInitializeSid

  CopySid

  GetLengthSid

  InitializeSecurityDescriptor

  SetSecurityDescriptorDacl

  SetSecurityDescriptorOwner

  RegCreateKeyA

  RegCreateKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegEnumKeyA

  RegSetValueExA

  user32

  MsgWaitForMultipleObjects

  PostThreadMessageA

  PeekMessageA

  FindWindowA

  GetClipboardOwner

  GetCursorPos

  GetForegroundWindow

  GetCapture

  GetQueueStatus

  SendMessageA

  kernel32

  WriteConsoleW

  SetEndOfFile

  HeapSize

  GetTimeZoneInformation

  CreateFileW

  GetProcessHeap

  GetStringTypeW

  SetStdHandle

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetTickCount

  GetProcAddress

  GetStdHandle

  ReadFile

  WriteFile

  GetConsoleMode

  SetConsoleMode

  FreeLibrary

  LoadLibraryExA

  CloseHandle

  GetLastError

  GetOverlappedResult

  SetEvent

  WaitForSingleObject

  CreateEventA

  CreateThread

  GetSystemDirectoryA

  GetVersionExA

  LoadLibraryA

  FormatMessageA

  SetHandleInformation

  FindClose

  FindFirstFileA

  FindNextFileA

  QueryPerformanceCounter

  GetProcessTimes

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetThreadTimes

  GetSystemTime

  GetSystemTimeAdjustment

  GetWindowsDirectoryA

  GlobalMemoryStatus

  CreateFileA

  LocalFree

  WaitNamedPipeA

  ConnectNamedPipe

  CreateNamedPipeA

  GetCurrentThreadId

  MapViewOfFile

  UnmapViewOfFile

  LocalAlloc

  CreateFileMappingA

  GetFileSize

  GetFileType

  EnumCalendarInfoA

  CreatePipe

  CreateProcessA

  OpenProcess

  ClearCommBreak

  GetCommState

  SetCommBreak

  SetCommState

  SetCommTimeouts

  ReleaseMutex

  CreateMutexA

  GetEnvironmentVariableA

  DeleteFileA

  GetLocalTime

  MultiByteToWideChar

  WideCharToMultiByte

  GetACP

  GetOEMCP

  GetCPInfo

  IsDBCSLeadByteEx

  GetCommandLineW

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  InterlockedPushEntrySList

  InterlockedFlushSList

  RtlUnwind

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  LoadLibraryExW

  EncodePointer

  RaiseException

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameW

  HeapFree

  HeapAlloc

  GetDateFormatW

  GetTimeFormatW

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  FlushFileBuffers

  GetConsoleOutputCP

  GetFileSizeEx

  SetFilePointerEx

  HeapReAlloc

  SetConsoleCtrlHandler

  ReadConsoleW

  OutputDebugStringW

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetCommandLineA

  DecodePointer

  Sections

  .text

  Size: 632KB - Virtual size: 632KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 116KB - Virtual size: 115KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 44KB - Virtual size: 43KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 22KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ