2024-05-26_a15571e12fb71d84effb89a844458769_avoslocker_metamorfo_revil

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-26_a15571e12fb71d84effb89a844458769_avoslocker_metamorfo_revil
Size 21.3MB
Sample240526-mshqlagb95
SHA256 1c71dacf752a328c5a3435efbd950a55442667e49c082d792dcdfcd2cf8c2226
MD5 a15571e12fb71d84effb89a844458769
SHA1 b978edc665e9a0b96311a312179a32c5a3719241
SHA512 667fa28ef8b57f6d703ebe46fbe4d8f6a46adf08000ba651c8b6486cf9e39e21398b9184741594099dc1d420f15013e735029cf3cc7e1b32bf449d7e9387e602
SSDEEP 196608:6CfsQRc4Zkr+K6SHULTHpFnsVufrqN8aUQGXgXCS1gJyLzr:6FUarEJhsofrqNF/GXgT1v
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-05-26_a15571e12fb71d84effb89a844458769_avoslocker_metamorfo_revil

.exe 21.3MB

2024-05-26_a15571e12fb71d84effb89a844458769_avoslocker_metamorfo_revil

IMPHASH 65a603fdc32eed194c86af51cc334e46
SHA256 1c71dacf752a328c5a3435efbd950a55442667e49c082d792dcdfcd2cf8c2226
MD5 a15571e12fb71d84effb89a844458769
SHA1 b978edc665e9a0b96311a312179a32c5a3719241
SHA512 667fa28ef8b57f6d703ebe46fbe4d8f6a46adf08000ba651c8b6486cf9e39e21398b9184741594099dc1d420f15013e735029cf3cc7e1b32bf449d7e9387e602
SSDEEP 196608:6CfsQRc4Zkr+K6SHULTHpFnsVufrqN8aUQGXgXCS1gJyLzr:6FUarEJhsofrqNF/GXgT1v
MD5 SHA1 SHA512 SSDEEP

Digest

58:21:00:22:5b:38:a7:0c:b0:b1:22:5c:e6:cc:ae:21:4c:29:3f:bb:b2:86:32:a2:4f:1e:ac:f3:fb:5a:43:95

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=727035-6,CN=Avanquest Software (7270356 Canada Inc),O=Avanquest Software (7270356 Canada Inc),L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Chains

May 24, 2024

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 7, 2021 - Dec 29, 2040

Subject

Serial Number

41:20:3f:a4:7b:99:d3:12:6f:05:65:21:05:71:57:86

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 16, 2022 - Sep 16, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4721727

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\TemporaryBuilds\azure-installer-pool-de-1\14\s\_bin\suite2021\Win32\PDFSuite2021Installer.pdb

kernel32

CloseHandle HeapAlloc GetProcessHeap HeapFree CreateEventA SetEvent CreateDirectoryW RemoveDirectoryW WaitForSingleObjectEx GetCurrentThreadId GetCurrentProcess LocalAlloc LocalFree GetDriveTypeW InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetCommandLineW GetLastError RaiseException GetModuleHandleW GetProcAddress DecodePointer InitializeCriticalSectionAndSpinCount InterlockedDecrement CreateThread WaitForSingleObject CreateEventW GetCurrentProcessId MultiByteToWideChar WideCharToMultiByte CreateFileW GetModuleFileNameW GetFileSize ReadFile HeapDestroy HeapReAlloc HeapSize TerminateProcess OutputDebugStringW SetUnhandledExceptionFilter InterlockedExchange GetDiskFreeSpaceExW GetLogicalDriveStringsW FindResourceW LoadResource LockResource SizeofResource DeleteFileW SetFileAttributesW GetFullPathNameW GetVersionExW WriteFile CopyFileW CreateProcessW FindFirstFileW FindNextFileW FindClose Sleep CreateMutexW ReleaseMutex LoadLibraryW FreeLibrary ReleaseSemaphore CreateSemaphoreA WaitForMultipleObjectsEx InterlockedIncrement lstrcmpiW LoadLibraryExW QueryPerformanceCounter QueryPerformanceFrequency CreateMutexA GetUserDefaultLCID OpenProcess CreateToolhelp32Snapshot Module32FirstW Module32NextW IsWow64Process GetExitCodeProcess Process32FirstW Process32NextW GetModuleHandleA BeginUpdateResourceW UpdateResourceW EndUpdateResourceW GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetModuleFileNameA LoadLibraryExA FormatMessageW SetLastError DuplicateHandle TlsAlloc WaitForMultipleObjects TerminateThread QueueUserAPC InterlockedExchangeAdd PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus InterlockedCompareExchange VerSetConditionMask VerifyVersionInfoW ProcessIdToSessionId TlsGetValue TlsSetValue TlsFree GetSystemInfo GetTickCount GetStdHandle OutputDebugStringA GetTempPathA GetWindowsDirectoryA GetComputerNameA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetSystemTimeAsFileTime SetFilePointer SetFileTime SystemTimeToFileTime LocalFileTimeToFileTime GetCurrentDirectoryW GetFileAttributesW lstrcpynW SwitchToThread UnmapViewOfFile CreateFileMappingA FormatMessageA GlobalSize LoadLibraryA GetTempFileNameA GetLocaleInfoA FindResourceA MulDiv ExitThread GetCPInfo SetThreadLocale GetNumberFormatW GetCurrencyFormatW GetSystemTime GetLocalTime GetTimeZoneInformation FileTimeToSystemTime GetLocaleInfoW GetDateFormatW GetThreadLocale GetVersionExA SetEndOfFile MapViewOfFile FlushViewOfFile CompareStringW GetTempPathW SleepEx GetSystemDirectoryA VerifyVersionInfoA ExpandEnvironmentStringsA GetFileType PeekNamedPipe GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetModuleHandleExW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetCurrentThread GetThreadTimes UnregisterWaitEx VirtualProtect VirtualQuery GetWindowsDirectoryW GetFileAttributesExW ResetEvent UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetStringTypeW GetExitCodeThread TryEnterCriticalSection QueueUserWorkItem EncodePointer LCMapStringW OpenEventA ResumeThread CreateWaitableTimerA SetFilePointerEx DeviceIoControl AreFileApisANSI GetStringTypeExW LCMapStringA GetStringTypeExA IsValidCodePage IsDBCSLeadByteEx EnumSystemLocalesA FoldStringW GetTimeFormatW CreateProcessA RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetConsoleCtrlHandler VirtualAlloc WriteConsoleW GetConsoleCP ExitProcess SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread GetACP IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle CreatePipe FindFirstFileExW GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait VirtualFree InterlockedPopEntrySList QueryDepthSList GetStringTypeA

??0?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@QAE@XZ ??0?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ ??0?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ ??1?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@QAE@XZ ??1?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@QAE@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UtagRECT@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@UtagRECT@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@3@XZ ?get_lock@singleton_module@serialization@boost@@CAAA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@SA_NXZ ?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@CAAA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@SAXXZ ?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@UtagRECT@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@VPlacement@HtmlWindowPlacementStrategy@GuiFramework@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?unlock@singleton_module@serialization@boost@@SAXXZ

generic

count=45, id=241, version=40116,

count=208, id=243, version=40116,

count=36, id=242, version=40116,

count=70, id=261, productName=VS2017 v15.6.6 build 26131, version=26131,

count=10, id=199, version=41118,

count=40, id=260, version=26706,

count=29, id=259, version=26706,

count=146, id=261, version=26706,

count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=23, productName=Unmarked objects (old),

count=721, id=260, productName=VS2017 v15.7.3 build 26430, version=26430,

count=746, id=1, productName=Unmarked objects,

count=211, id=261, productName=VS2017 v15.7.3 build 26430, version=26430,

count=3, id=261, productName=VS2019 v16.9.2 build 29913, version=29913,

count=162, id=264, version=27049,

count=1, id=256, version=27049,

count=1, id=255, version=27049,

count=1, id=151,

count=1, id=258, version=27049,