2024-06-02_ec5d52b322f62cc37014cf1ccf601c6c_avoslocker_revil

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-02_ec5d52b322f62cc37014cf1ccf601c6c_avoslocker_revil
Size 4.2MB
Sample240602-2c9lpsad45
SHA256 18154a1852f9b2abc5cea484943de37986b356ee6f35d8f4735b08c1d8f5c53c
MD5 ec5d52b322f62cc37014cf1ccf601c6c
SHA1 a2128f549af90646a800b048dc1342e070788dde
SHA512 ca512b8d06e7f13ded8b4e4dc4f4a73f6fea810cd2a27e368fa841a05227c71fb721a9e9a5aa0fe805feaa351e19deaef626b33a0a9710478c082e8ef930d30a
SSDEEP 98304:pNO49SyS6MML/WXBi4Oawh3Jh+wLBcS5ZB7zHa6hjyDc:S417KvwhUAB7zHaKB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-06-02_ec5d52b322f62cc37014cf1ccf601c6c_avoslocker_revil

File Explorer

2024-06-02_ec5d52b322f62cc37014cf1ccf601c6c_avoslocker_revil

.exe 4.2MB

2024-06-02_ec5d52b322f62cc37014cf1ccf601c6c_avoslocker_revil

IMPHASH 48a17fed098fdbc280af82f33ad98c9e
SHA256 18154a1852f9b2abc5cea484943de37986b356ee6f35d8f4735b08c1d8f5c53c
MD5 ec5d52b322f62cc37014cf1ccf601c6c
SHA1 a2128f549af90646a800b048dc1342e070788dde
SHA512 ca512b8d06e7f13ded8b4e4dc4f4a73f6fea810cd2a27e368fa841a05227c71fb721a9e9a5aa0fe805feaa351e19deaef626b33a0a9710478c082e8ef930d30a
SSDEEP 98304:pNO49SyS6MML/WXBi4Oawh3Jh+wLBcS5ZB7zHa6hjyDc:S417KvwhUAB7zHaKB
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2844347

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\fhdjclt\steam_plugin\SteamPlugin\bin\douyinHelper.pdb

ws2_32

gethostbyname freeaddrinfo htonl ntohs getaddrinfo gethostname WSAStartup WSACleanup WSAGetLastError __WSAFDIsSet WSASetLastError recv send bind closesocket connect getpeername getsockname getsockopt htons setsockopt socket WSAIoctl accept listen recvfrom sendto ioctlsocket shutdown getservbyname select

wldap32

ord60 ord50 ord211 ord46 ord22 ord26 ord27 ord32 ord33 ord35 ord41 ord79 ord30 ord200 ord301 ord143

kernel32

SystemTimeToFileTime lstrcpynW SetThreadPriority CreateThread SetNamedPipeHandleState DisconnectNamedPipe ReadFileEx WaitNamedPipeW FlushFileBuffers GlobalSize LocalFree OutputDebugStringA EncodePointer GetSystemDirectoryW LoadLibraryExW GlobalDeleteAtom GlobalAddAtomW GlobalFindAtomW lstrcmpA GetFullPathNameW GetVolumeInformationW LockFile SetEndOfFile UnlockFile GetThreadLocale FileTimeToSystemTime GetCurrentThread FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTime GetModuleHandleA LocalAlloc LocalReAlloc GlobalGetAtomNameW GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GlobalFlags GetFileTime GetCurrentDirectoryW FindResourceExW VerifyVersionInfoW GetTempFileNameW GetProfileIntW SearchPathW GetUserDefaultLCID UnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW FreeLibraryAndExitThread ExitThread VirtualQuery VirtualAlloc InterlockedFlushSList InterlockedPushEntrySList RtlUnwind LCMapStringW QueryPerformanceFrequency GetCPInfo GetStringTypeW FlushConsoleInputBuffer GlobalMemoryStatus QueryPerformanceCounter VerifyVersionInfoA GlobalReAlloc LoadLibraryA GetSystemDirectoryA VerSetConditionMask ExpandEnvironmentStringsA WaitForMultipleObjects GetFileType GetStdHandle WaitForSingleObjectEx FormatMessageA SleepEx GetTickCount64 DuplicateHandle lstrcmpiW GetDriveTypeW GetLogicalDriveStringsW GetFileSizeEx GetTempPathW DecodePointer HeapAlloc HeapReAlloc HeapSize InitializeCriticalSectionEx TerminateThread GetExitCodeThread TryEnterCriticalSection InitializeCriticalSectionAndSpinCount SetLastError GetPrivateProfileIntW GetPrivateProfileStringW SetUnhandledExceptionFilter CreateMutexW RaiseException SetProcessWorkingSetSize ResetEvent SetEvent FreeResource GlobalAlloc ResumeThread GlobalFree MulDiv GlobalUnlock GlobalLock CreateEventW CompareStringW IsValidCodePage RemoveDirectoryW FindClose FindNextFileW FindFirstFileW WritePrivateProfileStringW GetWindowsDirectoryW MoveFileExW DeleteFileW FormatMessageW GetACP WriteFile CopyFileW GetFileSize SetFilePointer GetFileAttributesW LeaveCriticalSection OutputDebugStringW EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetCurrentProcess CreateFileW GetCurrentProcessId GetCurrentThreadId CreateDirectoryW GetLocalTime GetModuleHandleExW SetErrorMode HeapFree GetProcessHeap LoadLibraryW VirtualProtect FreeLibrary lstrcpyW WideCharToMultiByte Process32NextW Process32FirstW CreateToolhelp32Snapshot Sleep TerminateProcess GetTickCount PeekNamedPipe GetLastError ReadFile WaitForSingleObject CreateProcessW lstrcmpW GetFileAttributesExW MultiByteToWideChar GetModuleFileNameW ReadProcessMemory CloseHandle OpenProcess GetSystemInfo GetModuleHandleW GetProcAddress FindResourceW LoadResource LockResource SizeofResource GetVersionExW GetCommandLineA GetCommandLineW GetFileInformationByHandle SetFilePointerEx ExitProcess SetConsoleCtrlHandler GetConsoleCP HeapQueryInformation SetStdHandle GetConsoleMode ReadConsoleW GetDateFormatW GetTimeFormatW IsValidLocale EnumSystemLocalesW GetTimeZoneInformation SetConsoleMode ReadConsoleInputW FindFirstFileExW GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW SignalObjectAndWait SwitchToThread GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes VirtualFree ReleaseSemaphore InterlockedPopEntrySList QueryDepthSList UnregisterWaitEx CreateTimerQueue GlobalHandle

user32

CheckDlgButton GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo GetLastActivePopup GetClassLongW GetWindowTextLengthW GetWindowTextW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow ValidateRect EndPaint BeginPaint TrackPopupMenu SetMenu GetMenu GetDlgCtrlID EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement IsMenu RegisterClassW PeekMessageW DispatchMessageW RemoveMenu GetMenuItemID GetSubMenu GetMenuState GetMenuStringW MessageBoxA GetUserObjectInformationW GetProcessWindowStation GetClassInfoExW UnregisterClassW SetParent DrawIcon LoadIconW PostQuitMessage CreateWindowExW RegisterClassExW DestroyWindow PostThreadMessageW ShowWindow MessageBoxW MoveWindow RegisterWindowMessageW GetCursorPos CallWindowProcW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetIconInfo LoadBitmapW GetMessagePos GetMessageTime AdjustWindowRectEx SetClassLongW MapVirtualKeyW GetTopWindow MessageBeep ScreenToClient SetLayeredWindowAttributes UpdateLayeredWindow SetForegroundWindow DefWindowProcW GetClassInfoW SetFocus IsChild DrawIconEx IsIconic IntersectRect SetTimer MapWindowPoints GetClientRect InflateRect GetSysColorBrush DrawFrameControl ModifyMenuW InsertMenuW AppendMenuW DeleteMenu LoadMenuW SetMenuItemInfoW GetMenuItemInfoW GetMenuItemCount SystemParametersInfoW LoadImageW GetKeyState InvalidateRect DestroyIcon FillRect ReleaseDC GetDC SetActiveWindow GetActiveWindow GetNextDlgTabItem GetMenuDefaultItem CreatePopupMenu NotifyWinEvent InvertRect HideCaret TrackMouseEvent SetPropW GetPropW RegisterClipboardFormatW GetWindow IsWindowEnabled GetDlgItem GetClassNameW TabbedTextOutW DrawTextW DrawTextExW GrayStringW GetFocus IsZoomed PtInRect KillTimer ReleaseCapture SetCapture LoadCursorW SetCursor GetCursor UpdateWindow RedrawWindow EqualRect GetSysColor SetRect IsRectEmpty OffsetRect SetRectEmpty SetWindowTextW IsDialogMessageW CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions GetWindowDC WindowFromPoint CharUpperW DestroyMenu SetWindowContextHelpId MapDialogRect CharNextW CopyAcceleratorTableW InvalidateRgn CopyRect EnableWindow PostMessageW RemovePropW GetMessageW TranslateMessage ShowOwnedPopups CopyImage SendDlgItemMessageA RealChildWindowFromPoint CreateDialogIndirectParamW EndDialog GetAsyncKeyState GetCapture GetNextDlgGroupItem DestroyCursor CreateMenu SubtractRect TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar GetUpdateRect IsClipboardFormatAvailable CharUpperBuffW GetDoubleClickTime SetMenuDefaultItem LockWindowUpdate DestroyAcceleratorTable CreateAcceleratorTableW GetKeyboardState ToUnicodeEx MapVirtualKeyExW IsCharLowerW GetKeyboardLayout WaitMessage GetComboBoxInfo ReuseDDElParam UnpackDDElParam InsertMenuItemW TranslateAcceleratorW LoadAcceleratorsW MonitorFromPoint UnionRect FrameRect CopyIcon SetCursorPos BringWindowToTop GetSystemMenu DrawEdge DrawStateW EmptyClipboard SetClipboardData CloseClipboard OpenClipboard EnumDisplayMonitors SetWindowRgn GetKeyNameTextW EnableScrollBar DrawFocusRect GetWindowRgn SetWindowLongW SetWindowPos GetSystemMetrics GetWindowRect GetDesktopWindow GetParent GetForegroundWindow IsWindowVisible IsWindow FindWindowExW GetWindowThreadProcessId SendMessageW ClientToScreen GetWindowLongW

gdi32

CreatePolygonRgn PtInRegion GetPixel SaveDC RestoreDC SetPixel CreateBitmap GetTextColor GetTextMetricsW GetTextExtentExPointW SetTextCharacterExtra CopyMetaFileW CreateDCW SetBkColor SetTextColor CreateHatchBrush CreatePen CreatePatternBrush ExcludeClipRect GetClipBox GetObjectType GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo SelectPalette SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign MoveToEx GetTextExtentPoint32W SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx GetMapMode PatBlt SetRectRgn DPtoLP GetBkColor GetRgnBox EnumFontFamiliesExW CreatePalette GetNearestPaletteIndex GetPaletteEntries GetSystemPaletteEntries RealizePalette CreateDIBitmap EnumFontFamiliesW GetTextCharsetInfo CreateEllipticRgn Ellipse Polygon Polyline LPtoDP Rectangle RoundRect FillRgn FrameRgn GetBoundsRect ExtFloodFill SetPaletteEntries SetPixelV GetWindowOrgEx GetViewportOrgEx GetTextFaceW GetStockObject StretchBlt CreateCompatibleBitmap BitBlt CreateSolidBrush GetDeviceCaps PtVisible RectVisible TextOutW ExtTextOutW Escape CreateEllipticRgnIndirect OffsetRgn CombineRgn CreateRectRgnIndirect CreateFontIndirectW CreateDIBSection GetObjectW GetDIBColorTable SetDIBColorTable SelectObject DeleteDC SelectClipRgn CreateRectRgn GetClipRgn DeleteObject ExtSelectClipRgn SetViewportExtEx CreateCompatibleDC CreateRoundRectRgn

msimg32

AlphaBlend TransparentBlt GradientFill

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegQueryValueExW RegCloseKey RegEnumKeyExW RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW RegOpenKeyExW ReportEventA RegisterEventSourceA DeregisterEventSource RegDisableReflectionKey RegEnableReflectionKey RegSetValueExW RegCreateKeyExW

shell32

ShellExecuteExW SHGetFileInfoW SHGetPathFromIDListW SHGetSpecialFolderLocation SHAppBarMessage SHBrowseForFolderW ShellExecuteW DragFinish DragQueryFileW SHGetDesktopFolder

comctl32

DrawShadowText _TrackMouseEvent InitCommonControlsEx

shlwapi

PathFileExistsW PathRemoveFileSpecW PathRemoveExtensionW PathIsUNCW PathStripToRootW PathFindExtensionW PathFindFileNameW StrFormatKBSizeW

uxtheme

GetThemePartSize GetThemeSysColor IsThemeBackgroundPartiallyTransparent IsAppThemed GetWindowTheme DrawThemeText DrawThemeParentBackground GetCurrentThemeName GetThemeColor DrawThemeBackground CloseThemeData OpenThemeData

ole32

CoLockObjectExternal CoCreateInstance IsAccelerator OleTranslateAccelerator OleDestroyMenuDescriptor OleCreateMenuDescriptor OleLockRunning RevokeDragDrop RegisterDragDrop CoCreateGuid OleGetClipboard DoDragDrop CoRegisterMessageFilter OleIsCurrentClipboard OleFlushClipboard CoRevokeClassObject OleUninitialize OleInitialize CoFreeUnusedLibraries CoDisconnectObject CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoGetClassObject CLSIDFromProgID CLSIDFromString ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CreateStreamOnHGlobal CoInitializeEx CoUninitialize CoInitialize

oleaut32

LoadTypeLi SysAllocString SysStringLen SysFreeString SysAllocStringLen VariantInit VariantClear VariantChangeType VariantCopy SystemTimeToVariantTime VariantTimeToSystemTime SafeArrayDestroy VarBstrFromDate OleCreateFontIndirect

gdiplus

GdipGetImageGraphicsContext GdipBitmapUnlockBits GdipBitmapLockBits GdipGetImagePalette GdipGetImagePaletteSize GdipGetImageWidth GdipGetImageHeight GdiplusStartup GdipGetImagePixelFormat GdipCreateBitmapFromFile GdiplusShutdown GdipLoadImageFromFile GdipDrawImageRectI GdipFillRectangleI GdipDeleteBrush GdipCloneBrush GdipCreateSolidFill GdipTranslateTextureTransform GdipCreateTexture2I GdipCreateTextureIAI GdipFillEllipseI GdipScaleTextureTransform GdipSetSmoothingMode GdipGetDC GdipReleaseDC GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipSetPageUnit GdipDeleteFontFamily GdipDrawImageI GdipDeleteFont GdipGetFamily GdipGetFontSize GdipGetFontStyle GdipSetTextRenderingHint GdipDrawString GdipCreatePath GdipDeletePath GdipAddPathString GdipCreatePen1 GdipDeletePen GdipSetPenLineJoin GdipDrawPath GdipFillPath GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetPropertyItemSize GdipGetPropertyItem GdipImageSelectActiveFrame GdipCreateBitmapFromStream GdipDrawImageRectRectI GdipDisposeImage GdipDeleteGraphics GdipSetInterpolationMode GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesWrapMode GdipSetImageAttributesColorKeys GdipCreateBitmapFromScan0 GdipCreateBitmapFromHBITMAP GdipCloneImage GdipCreateFontFromDC GdipCreateFromHDC GdipAlloc GdipFree

oledlg

OleUIBusyW

winmm

timeSetEvent PlaySoundW

iphlpapi

GetAdaptersInfo

dbghelp

MiniDumpWriteDump

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

imm32

ImmGetContext ImmReleaseContext ImmGetOpenStatus

??0CNamedPipeClientEvent@@QAE@ABV0@@Z ??0CNamedPipeClientEvent@@QAE@PAUINamePipeClitEvent@NS_IPC@@@Z ??0INamePipeClitEvent@NS_IPC@@QAE@$$QAU01@@Z ??0INamePipeClitEvent@NS_IPC@@QAE@ABU01@@Z ??0INamePipeClitEvent@NS_IPC@@QAE@XZ ??0INamedPipe@@QAE@$$QAU0@@Z ??0INamedPipe@@QAE@ABU0@@Z ??0INamedPipe@@QAE@XZ ??0INamedPipeEvent@@QAE@$$QAU0@@Z ??0INamedPipeEvent@@QAE@ABU0@@Z ??0INamedPipeEvent@@QAE@XZ ??0INamedPipeServer@@QAE@$$QAU0@@Z ??0INamedPipeServer@@QAE@ABU0@@Z ??0INamedPipeServer@@QAE@XZ ??0INamedPipeServerRoutine@@QAE@$$QAU0@@Z ??0INamedPipeServerRoutine@@QAE@ABU0@@Z ??0INamedPipeServerRoutine@@QAE@XZ ??1CNamedPipeClientEvent@@QAE@XZ ??4CNamedPipeClientEvent@@QAEAAV0@ABV0@@Z ??4INamePipeClitEvent@NS_IPC@@QAEAAU01@$$QAU01@@Z ??4INamePipeClitEvent@NS_IPC@@QAEAAU01@ABU01@@Z ??4INamedPipe@@QAEAAU0@$$QAU0@@Z ??4INamedPipe@@QAEAAU0@ABU0@@Z ??4INamedPipeEvent@@QAEAAU0@$$QAU0@@Z ??4INamedPipeEvent@@QAEAAU0@ABU0@@Z ??4INamedPipeServer@@QAEAAU0@$$QAU0@@Z ??4INamedPipeServer@@QAEAAU0@ABU0@@Z ??4INamedPipeServerRoutine@@QAEAAU0@$$QAU0@@Z ??4INamedPipeServerRoutine@@QAEAAU0@ABU0@@Z ??_7CNamedPipeClientEvent@@6B@ ??_7INamePipeClitEvent@NS_IPC@@6B@ ??_7INamedPipe@@6B@ ??_7INamedPipeEvent@@6B@ ??_7INamedPipeServer@@6B@ ??_7INamedPipeServerRoutine@@6B@ ?OnBeforeRelease@CNamedPipeClientEvent@@UAGHPAUINamedPipe@@@Z ?OnCompletedConnect@CNamedPipeClientEvent@@UAGXPAUINamedPipe@@@Z ?OnCompletedCreate@CNamedPipeClientEvent@@UAGXPAUINamedPipe@@@Z ?OnCompletedDisconnect@CNamedPipeClientEvent@@UAGHPAUINamedPipe@@@Z ?OnCompletedRecv@CNamedPipeClientEvent@@UAGKPAUINamedPipe@@PBDK@Z ?OnCompletedSend@CNamedPipeClientEvent@@UAGHPAUINamedPipe@@PBDK@Z ?SetNamedPipeEvent@CNamedPipeClientEvent@@QAEXPAUINamePipeClitEvent@NS_IPC@@@Z

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

751KB

Virtual Size

751KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

70KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

205KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=33, id=259, version=26715,

count=6, id=199, version=41118,

count=1, id=263, version=26715,

count=3, id=261, version=23013,

count=44, id=260, version=26715,

count=231, id=261, version=26715,

count=3, id=262, version=26715,

count=27, id=259, version=24123,

count=37, id=260, version=24123,

count=439, id=261, version=24123,

count=51, id=257, version=26715,

count=995, id=1, productName=Unmarked objects,

count=20, productName=Unmarked objects (old),

count=564, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=98, id=265, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,