2024-05-30_ff954997033f5aa4cd5d70bff1430556_avoslocker_cobalt-strike

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-30_ff954997033f5aa4cd5d70bff1430556_avoslocker_cobalt-strike
Size

724KB
MD5

ff954997033f5aa4cd5d70bff1430556
SHA1

82f6d88e95f0e10d9c402f6d3ed5a3a8d3432482
SHA256

0eb969dce1869c0dd94fb7f51139ea136e1a38cebbfe6b1d3beaf8404705cf35
SHA512

717825c7b3ccd314e0c9a17bc48a9c0d2366514b99270ea448f20d7be82b8596d055c4cf54cfcc941e31bc1d64c382c82ecaed3235859c6b40dfae90dfd2ba4c
SSDEEP

12288:wZc08o70L43SZiHk/dg+vVeNFEIj2K+T4DPl0Tk7WdExQKuM:wZcEP3cMgdTVeNFygPJ78EyK3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-05-30_ff954997033f5aa4cd5d70bff1430556_avoslocker_cobalt-strike

Files

2024-05-30_ff954997033f5aa4cd5d70bff1430556_avoslocker_cobalt-strike
.exe windows:6 windows x86 arch:x86

ff376f6b4fa772487aef59913a1aa537

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpOpen
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpSetTimeouts
WinHttpQueryOption
WinHttpConnect

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
FindClose
FindFirstFileW
GetFullPathNameW
GetVolumeInformationW
LockFile
UnlockFile
DuplicateHandle
GetThreadLocale
FileTimeToSystemTime
VirtualProtect
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesExW
GetFileSizeEx
InitializeCriticalSection
SetFileAttributesW
SystemTimeToTzSpecificLocalTime
GetTickCount
GetUserDefaultLCID
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CompareStringW
GlobalFindAtomW
GetSystemDirectoryW
EncodePointer
MulDiv
LoadLibraryA
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
FreeLibrary
GetCurrentThread
CreateEventW
SetEvent
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
GetACP
GlobalUnlock
GlobalLock
GlobalAlloc
OutputDebugStringW
FormatMessageW
FlushFileBuffers
GetFileSize
GetLocalTime
GlobalFree
GetCurrentThreadId
SetEndOfFile
GetEnvironmentVariableW
SetLastError
GetModuleHandleW
LoadLibraryExW
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlUnwind
GetCommandLineA
MoveFileExW
GetTimeZoneInformation
GetDriveTypeW
SetStdHandle
VerifyVersionInfoW
VerSetConditionMask
LocalFree
SetCurrentDirectoryW
GetVersionExW
LocalAlloc
GetCurrentProcess
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
CreateFileW
SetFilePointer
SetFileTime
WriteFile
ReadFile
CreateProcessW
CreateThread
Process32FirstW
Process32NextW
Sleep
CreateToolhelp32Snapshot
OpenProcess
GetFileAttributesW
TerminateProcess
IsBadStringPtrW
CopyFileW
GetCurrentProcessId
GetFileType
ExitProcess
GetModuleHandleExW
TlsAlloc
GetProcAddress
LoadLibraryW
DeleteFileW
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetStdHandle
WideCharToMultiByte
FindResourceW
LoadResource
CloseHandle
LockResource
MultiByteToWideChar
GetModuleFileNameW
GetCommandLineW
SizeofResource
CreateDirectoryW
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
HeapQueryInformation
GetSystemInfo
VirtualAlloc
VirtualQuery
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
SetFilePointerEx
LCMapStringW
IsValidLocale
EnumSystemLocalesW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetFileTime
WriteConsoleW

user32

IsRectEmpty
IntersectRect
SetRect
InvalidateRgn
CopyAcceleratorTableW
CharNextW
CharUpperW
GetSysColorBrush
LoadCursorW
ReleaseCapture
SetCapture
InvalidateRect
RealChildWindowFromPoint
DestroyMenu
ClientToScreen
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
IsDialogMessageW
SetWindowTextW
MoveWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
UnhookWindowsHookEx
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
EqualRect
GetSysColor
MapWindowPoints
GetNextDlgGroupItem
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
GetScrollPos
RedrawWindow
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
GetMenuItemCount
GetMenuItemID
MessageBeep
CopyRect
ReleaseDC
RegisterClipboardFormatW
PostThreadMessageW
ScreenToClient
GetDC
MapDialogRect
GetWindow
SetWindowContextHelpId
SetWindowPos
GetWindowRect
GetSubMenu
GetDesktopWindow
SetActiveWindow
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetLastActivePopup
GetWindowThreadProcessId
GetWindowLongW
IsWindowEnabled
SetCursor
PostQuitMessage
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetParent
OffsetRect
SetRectEmpty
SendDlgItemMessageA
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
GetSystemMenu
PostMessageW
MessageBoxW
SendMessageW
GetSystemMetrics
DrawIcon
ShowWindow
SetTimer
LoadIconW
GetClientRect
KillTimer
IsIconic
EnableWindow
UnregisterClassW
SetPropW

gdi32

ScaleViewportExtEx
ScaleWindowExtEx
GetBkColor
GetRgnBox
OffsetViewportOrgEx
SetWindowExtEx
SetViewportOrgEx
GetMapMode
SetViewportExtEx
ExtTextOutW
TextOutW
GetTextColor
SetMapMode
SelectObject
ExtSelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetClipBox
Escape
DeleteObject
GetObjectW
SetTextColor
SetBkColor
CreateBitmap
GetDeviceCaps
CreateRectRgnIndirect
DeleteDC

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

SetSecurityDescriptorDacl
RegSetValueExW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegOpenKeyExW
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
InitializeSecurityDescriptor
GetUserNameW
RegCloseKey
RegCreateKeyExW

shell32

SHGetFolderPathW
ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathIsURLW
PathRemoveFileSpecW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathFileExistsW

ole32

CoCreateInstance
CoCreateGuid
CoUninitialize
CoInitializeEx
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CoTaskMemFree
CoTaskMemAlloc
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CoInitialize

oleaut32

OleCreateFontIndirect
VariantCopy
SafeArrayDestroy
SysFreeString
SysAllocString
SysAllocStringLen
VariantInit
VariantClear
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantChangeType

oledlg

OleUIBusyW

oleacc

CreateStdAccessibleObject
LresultFromObject

Sections

.text
Size: 418KB - Virtual size: 418KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff376f6b4fa772487aef59913a1aa537

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

version

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

oleacc

Sections

.text Size: 418KB - Virtual size: 418KB

.rdata Size: 164KB - Virtual size: 163KB

.data Size: 10KB - Virtual size: 22KB

.rsrc Size: 84KB - Virtual size: 84KB

.reloc Size: 31KB - Virtual size: 30KB

.text
Size: 418KB - Virtual size: 418KB

.rdata
Size: 164KB - Virtual size: 163KB

.data
Size: 10KB - Virtual size: 22KB

.rsrc
Size: 84KB - Virtual size: 84KB

.reloc
Size: 31KB - Virtual size: 30KB