2024-05-27_abeb08ea0dd69780d984a1636fa675d5_avoslocker

Sharing

Copy URL Twitter E-mail

General

Target
2024-05-27_abeb08ea0dd69780d984a1636fa675d5_avoslocker
Size 8.8MB
Sample240527-q36f7aff77
SHA256 535c2b4d92494ad3fce834986773d37f4d7c847ba74d313ba02b639007307bc4
MD5 abeb08ea0dd69780d984a1636fa675d5
SHA1 e8957b39c144036bfad835c7d4c9e74526f1c7d0
SHA512 96e0b1511481516c3ebc94cf6e217d627aa83e5c387d64c4b617dbadd9af55c3c2d1ebef2ef70e82cfa57bd0374f36746b9eb828215528d7ec0354d4b3b455e6
SSDEEP 196608:UHwEuzhC4zX83bapo61gYgMzcTucF6vDzSEgkH4HYDV6nrg:2wxpzhxcTuc9D+Urg
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-27_abeb08ea0dd69780d984a1636fa675d5_avoslocker

File Explorer

2024-05-27_abeb08ea0dd69780d984a1636fa675d5_avoslocker

.exe 8.8MB

2024-05-27_abeb08ea0dd69780d984a1636fa675d5_avoslocker

IMPHASH 8ee42e5f3bd217c61ffad85590426d2a
SHA256 535c2b4d92494ad3fce834986773d37f4d7c847ba74d313ba02b639007307bc4
MD5 abeb08ea0dd69780d984a1636fa675d5
SHA1 e8957b39c144036bfad835c7d4c9e74526f1c7d0
SHA512 96e0b1511481516c3ebc94cf6e217d627aa83e5c387d64c4b617dbadd9af55c3c2d1ebef2ef70e82cfa57bd0374f36746b9eb828215528d7ec0354d4b3b455e6
SSDEEP 196608:UHwEuzhC4zX83bapo61gYgMzcTucF6vDzSEgkH4HYDV6nrg:2wxpzhxcTuc9D+Urg
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6935541

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

dbghelp

SymInitialize SymFromAddr SymGetLineFromAddr64

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW CryptAcquireContextW CryptReleaseContext CryptGenRandom RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegDeleteValueW RegEnumValueW RegEnumKeyW RegQueryInfoKeyW CryptAcquireContextA CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt SystemFunction036

ws2_32

WSAStartup gethostname WSAEnumNetworkEvents WSACleanup send WSACloseEvent gethostbyname WSACreateEvent WSAEventSelect shutdown WSARecvFrom WSARecv WSASocketW freeaddrinfo getaddrinfo ioctlsocket listen accept select __WSAFDIsSet WSAIoctl WSASetLastError socket setsockopt ntohs htons getsockopt getsockname getpeername connect closesocket bind WSAGetLastError recv WSAWaitForMultipleEvents WSAResetEvent

shell32

CommandLineToArgvW ShellExecuteA

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx CryptStringToBinaryA CertFindCertificateInStore CertOpenStore PFXIsPFXBlob PFXImportCertStore CertGetCertificateContextProperty CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore

kernel32

InitializeCriticalSectionAndSpinCount GetCPInfo CompareStringEx GetStringTypeW GetLocaleInfoEx UnhandledExceptionFilter IsDebuggerPresent SetUnhandledExceptionFilter LCMapStringEx DecodePointer EncodePointer IsProcessorFeaturePresent GetModuleHandleExW InitializeSListHead RtlUnwind ExitProcess SystemTimeToTzSpecificLocalTime ExitThread FreeLibraryAndExitThread GetCommandLineA HeapFree HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle SetStdHandle CreateFileW GetFileAttributesW GetFileSize GetLongPathNameW ReadFile SetFileAttributesW CloseHandle DuplicateHandle GetLastError SetLastError GetCurrentProcess GetCurrentProcessId GetSystemTimeAsFileTime GetVersionExW GetModuleFileNameW LocalFree FormatMessageA MoveFileExW GetConsoleScreenBufferInfo GetFileSizeEx GetFileType WriteFile MultiByteToWideChar WideCharToMultiByte GetACP GetConsoleCP GetConsoleMode ReadConsoleW WriteConsoleW FlushConsoleInputBuffer GetFileTime SetFileTime GetOEMCP GetCPInfoExW IsDBCSLeadByteEx IsWow64Process GetModuleHandleW GetProcAddress GetConsoleOutputCP LockFileEx UnlockFileEx FormatMessageW GetFileAttributesExW CreatePipe ExpandEnvironmentStringsW GetVolumeInformationA GetSystemDirectoryA GetWindowsDirectoryA GetCommandLineW GetFullPathNameW CompareFileTime DeleteFileW FindClose FindFirstFileW GetFileInformationByHandle GetShortPathNameW RemoveDirectoryW DeviceIoControl Sleep CreateSymbolicLinkW HeapReAlloc SetCurrentDirectoryW GetCurrentDirectoryW GetHandleInformation InitializeCriticalSection EnterCriticalSection LeaveCriticalSection ReleaseSemaphore WaitForSingleObject WaitForMultipleObjects CreateSemaphoreW TerminateProcess GetExitCodeProcess CreateThread ResumeThread CreateProcessW OpenProcess SetConsoleCtrlHandler GenerateConsoleCtrlEvent SetConsoleTextAttribute RtlCaptureStackBackTrace QueryPerformanceCounter QueryPerformanceFrequency GlobalMemoryStatusEx GetSystemInfo FreeLibrary LoadLibraryW lstrcmpiW LoadLibraryExW SleepEx GetModuleHandleA LoadLibraryA GetEnvironmentVariableA GetTickCount MoveFileExA VerSetConditionMask VerifyVersionInfoW CreateFileA CreateDirectoryW SetEndOfFile SetFilePointer GetTempPathW GetProcessHeap GetDiskFreeSpaceW GetDriveTypeW GetVolumePathNameW GetOverlappedResult CancelIo ResetEvent CreateEventW VirtualAlloc VirtualFree IsValidCodePage GetFileAttributesA PeekNamedPipe SearchPathA SetHandleInformation CreateProcessA DeleteCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS FlushFileBuffers GetFinalPathNameByHandleW SetFilePointerEx MapViewOfFile FlushViewOfFile UnmapViewOfFile CreateFileMappingA ReOpenFile CopyFileW CreateHardLinkW GetFileInformationByHandleEx GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW FileTimeToSystemTime CreateToolhelp32Snapshot Process32First Process32Next SetErrorMode CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW CancelIoEx CancelSynchronousIo CreateEventA SwitchToThread GetCurrentThread QueueUserWorkItem CreateNamedPipeA GetNamedPipeHandleStateA RegisterWaitForSingleObject UnregisterWait DebugBreak SetEvent GetNumberOfConsoleInputEvents ReadConsoleInputW SetConsoleCursorPosition WriteConsoleInputW UnregisterWaitEx CreateJobObjectW AssignProcessToJobObject SetInformationJobObject GetProcessAffinityMask SetProcessAffinityMask LCMapStringW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection WakeAllConditionVariable TlsAlloc TlsGetValue TlsSetValue TlsFree GetNativeSystemInfo CreateSemaphoreA LoadLibraryExA ReadDirectoryChangesW GetStartupInfoW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW InitializeCriticalSectionEx RaiseException GetCurrentThreadId WaitForSingleObjectEx AreFileApisANSI HeapSize GetTimeZoneInformation FindNextFileW FindFirstFileA FindFirstFileExW

user32

CharPrevExA GetMessageA GetSystemMetrics MapVirtualKeyW TranslateMessage DispatchMessageA

ole32

CoCreateInstance GetRunningObjectTable CreateBindCtx CoInitialize CoTaskMemFree CoInitializeEx CoUninitialize

oleaut32

SysAllocString SafeArrayDestroy SysFreeString VariantInit VariantClear

archive_clear_error archive_compression archive_compression_name archive_copy_error archive_entry_acl archive_entry_acl_add_entry archive_entry_acl_add_entry_w archive_entry_acl_clear archive_entry_acl_count archive_entry_acl_from_text archive_entry_acl_from_text_w archive_entry_acl_next archive_entry_acl_reset archive_entry_acl_text archive_entry_acl_text_w archive_entry_acl_to_text archive_entry_acl_to_text_w archive_entry_acl_types archive_entry_atime archive_entry_atime_is_set archive_entry_atime_nsec archive_entry_birthtime archive_entry_birthtime_is_set archive_entry_birthtime_nsec archive_entry_clear archive_entry_clone archive_entry_copy_fflags_text archive_entry_copy_fflags_text_w archive_entry_copy_gname archive_entry_copy_gname_w archive_entry_copy_hardlink archive_entry_copy_hardlink_w archive_entry_copy_link archive_entry_copy_link_w archive_entry_copy_mac_metadata archive_entry_copy_pathname archive_entry_copy_pathname_w archive_entry_copy_sourcepath archive_entry_copy_sourcepath_w archive_entry_copy_stat archive_entry_copy_symlink archive_entry_copy_symlink_w archive_entry_copy_uname archive_entry_copy_uname_w archive_entry_ctime archive_entry_ctime_is_set archive_entry_ctime_nsec archive_entry_dev archive_entry_dev_is_set archive_entry_devmajor archive_entry_devminor archive_entry_digest archive_entry_fflags archive_entry_fflags_text archive_entry_filetype archive_entry_free archive_entry_gid archive_entry_gname archive_entry_gname_utf8 archive_entry_gname_w archive_entry_hardlink archive_entry_hardlink_utf8 archive_entry_hardlink_w archive_entry_ino archive_entry_ino64 archive_entry_ino_is_set archive_entry_is_data_encrypted archive_entry_is_encrypted archive_entry_is_metadata_encrypted archive_entry_linkify archive_entry_linkresolver_free archive_entry_linkresolver_new archive_entry_linkresolver_set_strategy archive_entry_mac_metadata archive_entry_mode archive_entry_mtime archive_entry_mtime_is_set archive_entry_mtime_nsec archive_entry_new archive_entry_new2 archive_entry_nlink archive_entry_partial_links archive_entry_pathname archive_entry_pathname_utf8 archive_entry_pathname_w archive_entry_perm archive_entry_rdev archive_entry_rdevmajor archive_entry_rdevminor archive_entry_set_atime archive_entry_set_birthtime archive_entry_set_ctime archive_entry_set_dev archive_entry_set_devmajor archive_entry_set_devminor archive_entry_set_fflags archive_entry_set_filetype archive_entry_set_gid archive_entry_set_gname archive_entry_set_gname_utf8 archive_entry_set_hardlink archive_entry_set_hardlink_utf8 archive_entry_set_ino archive_entry_set_ino64 archive_entry_set_is_data_encrypted archive_entry_set_is_metadata_encrypted archive_entry_set_link archive_entry_set_link_utf8 archive_entry_set_mode archive_entry_set_mtime archive_entry_set_nlink archive_entry_set_pathname archive_entry_set_pathname_utf8 archive_entry_set_perm archive_entry_set_rdev archive_entry_set_rdevmajor archive_entry_set_rdevminor archive_entry_set_size archive_entry_set_symlink archive_entry_set_symlink_type archive_entry_set_symlink_utf8 archive_entry_set_uid archive_entry_set_uname archive_entry_set_uname_utf8 archive_entry_size archive_entry_size_is_set archive_entry_sourcepath archive_entry_sourcepath_w archive_entry_sparse_add_entry archive_entry_sparse_clear archive_entry_sparse_count archive_entry_sparse_next archive_entry_sparse_reset archive_entry_strmode archive_entry_symlink archive_entry_symlink_type archive_entry_symlink_utf8 archive_entry_symlink_w archive_entry_uid archive_entry_uname archive_entry_uname_utf8 archive_entry_uname_w archive_entry_unset_atime archive_entry_unset_birthtime archive_entry_unset_ctime archive_entry_unset_mtime archive_entry_unset_size archive_entry_update_gname_utf8 archive_entry_update_hardlink_utf8 archive_entry_update_link_utf8 archive_entry_update_pathname_utf8 archive_entry_update_symlink_utf8 archive_entry_update_uname_utf8 archive_entry_xattr_add_entry archive_entry_xattr_clear archive_entry_xattr_count archive_entry_xattr_next archive_entry_xattr_reset archive_errno archive_error_string archive_file_count archive_filter_bytes archive_filter_code archive_filter_count archive_filter_name archive_format archive_format_name archive_free archive_match_exclude_entry archive_match_exclude_pattern archive_match_exclude_pattern_from_file archive_match_exclude_pattern_from_file_w archive_match_exclude_pattern_w archive_match_excluded archive_match_free archive_match_include_date archive_match_include_date_w archive_match_include_file_time archive_match_include_file_time_w archive_match_include_gid archive_match_include_gname archive_match_include_gname_w archive_match_include_pattern archive_match_include_pattern_from_file archive_match_include_pattern_from_file_w archive_match_include_pattern_w archive_match_include_time archive_match_include_uid archive_match_include_uname archive_match_include_uname_w archive_match_new archive_match_owner_excluded archive_match_path_excluded archive_match_path_unmatched_inclusions archive_match_path_unmatched_inclusions_next archive_match_path_unmatched_inclusions_next_w archive_match_set_inclusion_recursion archive_match_time_excluded archive_position_compressed archive_position_uncompressed archive_read_add_callback_data archive_read_add_passphrase archive_read_append_callback_data archive_read_close archive_read_data archive_read_data_block archive_read_data_skip archive_read_disk_can_descend archive_read_disk_current_filesystem archive_read_disk_current_filesystem_is_remote archive_read_disk_current_filesystem_is_synthetic archive_read_disk_descend archive_read_disk_entry_from_file archive_read_disk_gname archive_read_disk_new archive_read_disk_open archive_read_disk_open_w archive_read_disk_set_atime_restored archive_read_disk_set_behavior archive_read_disk_set_gname_lookup archive_read_disk_set_matching archive_read_disk_set_metadata_filter_callback archive_read_disk_set_symlink_hybrid archive_read_disk_set_symlink_logical archive_read_disk_set_symlink_physical archive_read_disk_set_uname_lookup archive_read_disk_uname archive_read_extract_set_skip_file archive_read_finish archive_read_format_capabilities archive_read_free archive_read_has_encrypted_entries archive_read_header_position archive_read_new archive_read_next_header archive_read_next_header2 archive_read_open archive_read_open1 archive_read_open2 archive_read_open_file archive_read_open_filename archive_read_open_filename_w archive_read_open_filenames archive_read_prepend_callback_data archive_read_set_callback_data archive_read_set_callback_data2 archive_read_set_close_callback archive_read_set_open_callback archive_read_set_passphrase_callback archive_read_set_read_callback archive_read_set_seek_callback archive_read_set_skip_callback archive_read_set_switch_callback archive_read_support_compression_all archive_read_support_compression_bzip2 archive_read_support_compression_compress archive_read_support_compression_gzip archive_read_support_compression_lzip archive_read_support_compression_lzma archive_read_support_compression_program archive_read_support_compression_program_signature archive_read_support_compression_rpm archive_read_support_compression_uu archive_read_support_compression_xz archive_read_support_filter_all archive_read_support_filter_bzip2 archive_read_support_filter_compress archive_read_support_filter_grzip archive_read_support_filter_gzip archive_read_support_filter_lrzip archive_read_support_filter_lz4 archive_read_support_filter_lzip archive_read_support_filter_lzma archive_read_support_filter_lzop archive_read_support_filter_program archive_read_support_filter_program_signature archive_read_support_filter_rpm archive_read_support_filter_uu archive_read_support_filter_xz archive_read_support_filter_zstd archive_read_support_format_7zip archive_read_support_format_all archive_read_support_format_ar archive_read_support_format_cab archive_read_support_format_cpio archive_read_support_format_empty archive_read_support_format_gnutar archive_read_support_format_iso9660 archive_read_support_format_lha archive_read_support_format_mtree archive_read_support_format_rar archive_read_support_format_rar5 archive_read_support_format_raw archive_read_support_format_tar archive_read_support_format_warc archive_read_support_format_xar archive_read_support_format_zip archive_read_support_format_zip_seekable archive_read_support_format_zip_streamable archive_seek_data archive_set_error archive_utility_string_sort archive_version_number archive_version_string archive_write_add_filter_bzip2 archive_write_add_filter_compress archive_write_add_filter_gzip archive_write_add_filter_lzip archive_write_add_filter_lzma archive_write_add_filter_none archive_write_add_filter_xz archive_write_add_filter_zstd archive_write_close archive_write_data archive_write_data_block archive_write_disk_gid archive_write_disk_new archive_write_disk_set_group_lookup archive_write_disk_set_options archive_write_disk_set_skip_file archive_write_disk_set_user_lookup archive_write_disk_uid archive_write_fail archive_write_finish archive_write_finish_entry archive_write_free archive_write_get_bytes_in_last_block archive_write_get_bytes_per_block archive_write_header archive_write_new archive_write_open archive_write_open2 archive_write_set_bytes_in_last_block archive_write_set_bytes_per_block archive_write_set_compression_bzip2 archive_write_set_compression_compress archive_write_set_compression_gzip archive_write_set_compression_lzip archive_write_set_compression_lzma archive_write_set_compression_none archive_write_set_compression_xz archive_write_set_filter_option archive_write_set_format archive_write_set_format_7zip archive_write_set_format_ar_bsd archive_write_set_format_ar_svr4 archive_write_set_format_by_name archive_write_set_format_cpio archive_write_set_format_cpio_bin archive_write_set_format_cpio_newc archive_write_set_format_cpio_odc archive_write_set_format_cpio_pwb archive_write_set_format_gnutar archive_write_set_format_iso9660 archive_write_set_format_mtree archive_write_set_format_mtree_classic archive_write_set_format_option archive_write_set_format_pax archive_write_set_format_pax_restricted archive_write_set_format_raw archive_write_set_format_shar archive_write_set_format_shar_dump archive_write_set_format_ustar archive_write_set_format_v7tar archive_write_set_format_warc archive_write_set_format_xar archive_write_set_format_zip archive_write_set_option archive_write_set_options archive_write_set_passphrase archive_write_set_passphrase_callback archive_write_set_skip_file archive_write_zip_set_compression_deflate archive_write_zip_set_compression_store

Sharing

General

Malware Config

Signatures

File Explorer

2024-05-27_abeb08ea0dd69780d984a1636fa675d5_avoslocker

dbghelp

advapi32

ws2_32

shell32

rpcrt4

crypt32

kernel32

user32

ole32

oleaut32

generic