c:\buildslave\steam_rel_client_win32\build\src\steamUI\gamestream\secure_desktop_capture\Release\secure_desktop_capture.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_6649085270982567fc3bcfbd716051ed_avoslocker_revil.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-23_6649085270982567fc3bcfbd716051ed_avoslocker_revil.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-23_6649085270982567fc3bcfbd716051ed_avoslocker_revil
-
Size
3.5MB
-
MD5
6649085270982567fc3bcfbd716051ed
-
SHA1
cc66249b2fe3213bee61ff8606c32ac1a1416c4e
-
SHA256
571c1e0ee0f6d5536b4d2af507bade99f5f5009299fc904ba80368e3cedd1ff3
-
SHA512
53efc34b6246395cfbeb0e8439fb4458e1996f1b0e7003b69dc8576cf137eb07a900074f27e12b0e530bfccf061c7fabc906785fcd7a6c88b24bbbf6ace863fd
-
SSDEEP
49152:duvxvUDT8VVWFGQJnolA4l6fX98qzaFtPoIVVLFTLmvdRsA5hLDmg27RnWGj:duvxvUMuGCozl6f92OIVHm7D527BWG
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2024-05-23_6649085270982567fc3bcfbd716051ed_avoslocker_revil
Files
-
2024-05-23_6649085270982567fc3bcfbd716051ed_avoslocker_revil.exe windows:6 windows x86 arch:x86
9c0af97442cd57dbe067f5e8d72a9b84
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GlobalAlloc
GlobalUnlock
GlobalLock
LocalAlloc
LocalFree
MultiByteToWideChar
WriteConsoleW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
HeapReAlloc
SetFilePointerEx
SetStdHandle
HeapAlloc
HeapFree
LCMapStringW
CompareStringW
HeapValidate
HeapSize
SetConsoleCtrlHandler
ExitProcess
GetConsoleCP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
VirtualQuery
GetCurrentProcessId
Sleep
SetLastError
OutputDebugStringA
WriteFile
FreeEnvironmentStringsW
GetFullPathNameW
FindFirstFileW
FindClose
CreateFileW
LoadLibraryA
GetProcAddress
GetCurrentThreadId
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
OpenProcess
GetCurrentProcess
CreateEventA
WaitForSingleObject
ResetEvent
SetEvent
GetLastError
CloseHandle
LeaveCriticalSection
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
GetCPInfo
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetModuleHandleExW
EnterCriticalSection
GetStringTypeW
InitOnceComplete
InitOnceBeginInitialize
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetCurrentDirectoryW
FindNextFileW
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetEnvironmentVariableW
GetFileType
GetModuleHandleW
DeleteFiber
QueryPerformanceCounter
GetSystemTimeAsFileTime
ConvertFiberToThread
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetSystemTime
SystemTimeToFileTime
InitializeCriticalSection
GetCommandLineW
TerminateProcess
GlobalMemoryStatusEx
VirtualAlloc
GetModuleFileNameA
IsDebuggerPresent
GetCommandLineA
GetProcessHeap
HeapSetInformation
HeapLock
HeapUnlock
HeapWalk
HeapQueryInformation
QueryPerformanceFrequency
DuplicateHandle
RaiseException
TryEnterCriticalSection
SwitchToThread
CreateThread
GetCurrentThread
OpenThread
GetExitCodeThread
SetUnhandledExceptionFilter
LoadLibraryExA
LoadLibraryExW
DebugBreak
GetProcessHeaps
SetEnvironmentVariableW
FindFirstFileExW
FlushFileBuffers
GetDriveTypeW
GetFileInformationByHandle
GetFileSizeEx
ReadFile
SetEndOfFile
InitializeSRWLock
user32
OpenClipboard
CloseClipboard
SetClipboardData
SetDlgItemInt
GetWindowTextLengthA
GetDesktopWindow
CloseDesktop
OpenDesktopA
GetDlgItemInt
EmptyClipboard
SetDlgItemTextA
GetDlgItem
GetWindowThreadProcessId
EnumWindows
GetShellWindow
GetWindowRect
EndDialog
IsWindowVisible
ReleaseDC
GetDC
SetWindowPos
ShowWindow
GetCursorInfo
LoadCursorA
GetCursorPos
MessageBoxA
GetSystemMetrics
SendInput
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
wsprintfA
DialogBoxParamA
gdi32
GdiFlush
SetBrushOrgEx
CreateDIBSection
SetStretchBltMode
StretchBlt
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
BitBlt
advapi32
RegisterEventSourceW
ReportEventW
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey
SetSecurityDescriptorDacl
IsValidSid
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation
GetLengthSid
CreateWellKnownSid
CopySid
AddAccessAllowedAce
OpenProcessToken
DeregisterEventSource
shell32
CommandLineToArgvW
oleaut32
VariantClear
psapi
GetProcessMemoryInfo
bcrypt
BCryptGenRandom
ws2_32
recv
send
WSASetLastError
closesocket
WSAGetLastError
WSACleanup
Exports
Exports
CreateInterface
g_dwDllEntryThreadId
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 552KB - Virtual size: 552KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 27KB - Virtual size: 534KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 295KB - Virtual size: 295KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 648KB - Virtual size: 652KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE