2024-05-26_61b0c2ab6160dfa5f53130bc8c26287a_avoslocker_cobalt-strike

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-26_61b0c2ab6160dfa5f53130bc8c26287a_avoslocker_cobalt-strike
Size 992KB
Sample240526-mpr5vsga98
SHA256 694e4e28bb42b34467c1d373c77fad2dc9b451b8c4f8655ebdec4257855cab95
MD5 61b0c2ab6160dfa5f53130bc8c26287a
SHA1 e70fb6fd7ea553050c6a861152667faadd457df9
SHA512 778800548fe238ed357ea789873913a0c47113f1700880b1d18e960d76f64399ea7ff48580cc917a8c4789140cdad3c693d53293453b70badb55ba254a1a7527
SSDEEP 24576:LoLyj95+VkcPprGFigd/i328ab4F+rM/aXq6bJfBUam6:LozV1dGFJd/i3da1YS6ozB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-26_61b0c2ab6160dfa5f53130bc8c26287a_avoslocker_cobalt-strike

File Explorer

2024-05-26_61b0c2ab6160dfa5f53130bc8c26287a_avoslocker_cobalt-strike

.exe 992KB

2024-05-26_61b0c2ab6160dfa5f53130bc8c26287a_avoslocker_cobalt-strike

IMPHASH d35f09ffa2c37327caf4d3c5a751464c
SHA256 694e4e28bb42b34467c1d373c77fad2dc9b451b8c4f8655ebdec4257855cab95
MD5 61b0c2ab6160dfa5f53130bc8c26287a
SHA1 e70fb6fd7ea553050c6a861152667faadd457df9
SHA512 778800548fe238ed357ea789873913a0c47113f1700880b1d18e960d76f64399ea7ff48580cc917a8c4789140cdad3c693d53293453b70badb55ba254a1a7527
SSDEEP 24576:LoLyj95+VkcPprGFigd/i328ab4F+rM/aXq6bJfBUam6:LozV1dGFJd/i3da1YS6ozB
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

271696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mdmerge.pdb

kernel32

GetCommandLineW WaitForSingleObjectEx ResetEvent SetEvent SetEndOfFile GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleW GetModuleHandleExW GetProcAddress IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetLastError SetLastError GetCurrentThreadId HeapFree InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapAlloc IsValidCodePage GetACP GetOEMCP GetCPInfo GetProcessHeap HeapSize HeapReAlloc GetStringTypeW MultiByteToWideChar WideCharToMultiByte GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwind RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx FormatMessageW LocalFree DebugBreak SizeofResource GetFileAttributesW LockResource FindResourceExW LoadResource CreateDirectoryW FindFirstFileExW GetFullPathNameW FindNextFileW FindClose DeleteFileW GetCurrentDirectoryW GetLocaleInfoEx RaiseFailFastException GetTempPathW MoveFileExW CopyFileW GetTempFileNameW WriteConsoleW CreateFileW ReadConsoleW ReadFile SetFilePointerEx GetFileSizeEx CloseHandle GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW InitOnceExecuteOnce DecodePointer LCMapStringEx GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetEnvironmentStringsW CreateEventW

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

VariantClear SysFreeString SysAllocString

shlwapi

PathFileExistsW SHCreateStreamOnFileEx SHCreateStreamOnFileW

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec PathCchCanonicalizeEx

midlrtmd

CreatePEFile MetaDataGetDispenser

Sharing

General

Malware Config

Signatures

File Explorer

2024-05-26_61b0c2ab6160dfa5f53130bc8c26287a_avoslocker_cobalt-strike

kernel32

ole32

oleaut32

shlwapi

api-ms-win-core-path-l1-1-0

midlrtmd

generic