2024-06-05_2f0b206753d27b470f7ecf57669ef5a6_avoslocker_magniber_revil

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-05_2f0b206753d27b470f7ecf57669ef5a6_avoslocker_magniber_revil
Size 5.6MB
Sample240605-p3dkqsgf72
SHA256 284d342758e15500884eda4f4ae8fdb0fd62c645e76a99e1a5f36565de577fae
MD5 2f0b206753d27b470f7ecf57669ef5a6
SHA1 3bfbb76956f86d2b89f4514aa37cdd2d5e588bed
SHA512 0db3f2f22b8f1d59712b262b622365ce5dbe15e6cd2a30e37b730ad31c123253a4f765cd6aaafd20adc3c4d95d7bead0f46c42553c2c11569b2c80778c92c8a5
SSDEEP 98304:meF0/sAT4mGfckjASn3ZCto1N1BpxgTuiN54AR6KPOvB/JSSV:NSsATN+V3k0pxMkARP4z
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-06-05_2f0b206753d27b470f7ecf57669ef5a6_avoslocker_magniber_revil

.exe 5.6MB

2024-06-05_2f0b206753d27b470f7ecf57669ef5a6_avoslocker_magniber_revil

IMPHASH b58c27ae840da00c8885e7dd1f6265f8
SHA256 284d342758e15500884eda4f4ae8fdb0fd62c645e76a99e1a5f36565de577fae
MD5 2f0b206753d27b470f7ecf57669ef5a6
SHA1 3bfbb76956f86d2b89f4514aa37cdd2d5e588bed
SHA512 0db3f2f22b8f1d59712b262b622365ce5dbe15e6cd2a30e37b730ad31c123253a4f765cd6aaafd20adc3c4d95d7bead0f46c42553c2c11569b2c80778c92c8a5
SSDEEP 98304:meF0/sAT4mGfckjASn3ZCto1N1BpxgTuiN54AR6KPOvB/JSSV:NSsATN+V3k0pxMkARP4z
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

9c:be:86:16:43:6b:4d:fe:23:38:ad:ec:d8:1d:8a:94:79:09:ce:7f:82:07:97:19:86:32:93:56:8e:5d:71:f4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Jun 3, 2024

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

08:69:da:2a:42:bc:2f:94:c5:b7:e3:c0:22:91:31:f0:7c:6e:6a:f0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Jun 3, 2024

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Serial Number

05:a8:1d:3b:96:27:0d:9a:1d:eb:07:cd:88:67:d0:a9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 14, 2021 - Oct 16, 2024

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Serial Number

05:a8:1d:3b:96:27:0d:9a:1d:eb:07:cd:88:67:d0:a9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 14, 2021 - Oct 16, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2549463

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_bugfix_v12_i18n_202405_branch\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb

kernel32

GetCommandLineW SetEnvironmentVariableW SetUnhandledExceptionFilter GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FindResourceExW LoadResource LockResource SizeofResource FindResourceW CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetTickCount FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryA VerSetConditionMask CreateDirectoryW GetDiskFreeSpaceExW GetTempFileNameW GetTempPathW OutputDebugStringA CreateMutexW OpenMutexW GetExitCodeProcess OpenProcess GetSystemDirectoryA GetSystemDirectoryW GetVersionExW GetSystemWow64DirectoryW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte GetGeoInfoW GetUserGeoID CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetSystemTime LoadLibraryW GetSystemPowerStatus GetUserDefaultUILanguage GetSystemDefaultLCID GetUserDefaultLCID CreateFileW GetFileAttributesW GetFileSizeEx ReadFile GetCurrentProcess TerminateProcess GetCurrentThreadId GetProcessId GetDateFormatW GetFileInformationByHandle GetFileSize SetFilePointer WriteFile GetLocalTime CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime SystemTimeToFileTime VirtualAlloc VirtualFree DeleteFileW ExitProcess FreeResource lstrcpyW GetLocaleInfoW DecodePointer RaiseException InitializeCriticalSectionAndSpinCount GetStdHandle GetEnvironmentVariableW GetFileType SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FormatMessageW QueryPerformanceCounter GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency MoveFileExA CompareFileTime GetEnvironmentVariableA PeekNamedPipe WaitForMultipleObjects SleepEx GetVersionExA ExpandEnvironmentStringsA GetWindowsDirectoryA GetACP GetCurrentDirectoryW MulDiv GlobalAlloc GlobalUnlock GlobalLock LocalFree SetFileTime DuplicateHandle DosDateTimeToFileTime GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA CreateFileA DeviceIoControl CreateThread GetPrivateProfileStringW lstrlenW ExpandEnvironmentStringsW GetCurrentThread ProcessIdToSessionId CreateProcessW GetPrivateProfileIntW GetLongPathNameW CreateEventW GetFileAttributesExW SetEvent ResetEvent ReleaseSemaphore CreateSemaphoreW SystemTimeToTzSpecificLocalTime ReleaseMutex OpenFileMappingW IsDebuggerPresent OutputDebugStringW GetStringTypeW TryEnterCriticalSection SwitchToThread EncodePointer GetCPInfo CompareStringW LCMapStringW WaitForSingleObjectEx UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue RtlUnwind GetCommandLineA ExitThread GetDriveTypeW SetConsoleCtrlHandler SetFilePointerEx GetConsoleCP GetTimeFormatW IsValidLocale EnumSystemLocalesW FlushFileBuffers GetFullPathNameW SetStdHandle SetEndOfFile GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW FormatMessageA LockFileEx UnlockFile HeapCompact DeleteFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI

curl_easy_cleanup curl_easy_duphandle curl_easy_escape curl_easy_getinfo curl_easy_header curl_easy_init curl_easy_nextheader curl_easy_pause curl_easy_perform curl_easy_recv curl_easy_reset curl_easy_send curl_easy_setopt curl_easy_strerror curl_easy_unescape curl_easy_upkeep curl_escape curl_formadd curl_formfree curl_formget curl_free curl_getdate curl_getenv curl_global_cleanup curl_global_init curl_global_init_mem curl_global_sslset curl_global_trace curl_maprintf curl_mfprintf curl_mime_addpart curl_mime_data curl_mime_data_cb curl_mime_encoder curl_mime_filedata curl_mime_filename curl_mime_free curl_mime_headers curl_mime_init curl_mime_name curl_mime_subparts curl_mime_type curl_mprintf curl_msnprintf curl_msprintf curl_multi_add_handle curl_multi_assign curl_multi_cleanup curl_multi_fdset curl_multi_info_read curl_multi_init curl_multi_perform curl_multi_poll curl_multi_remove_handle curl_multi_setopt curl_multi_socket curl_multi_socket_action curl_multi_socket_all curl_multi_strerror curl_multi_timeout curl_multi_wait curl_multi_wakeup curl_mvaprintf curl_mvfprintf curl_mvprintf curl_mvsnprintf curl_mvsprintf curl_share_cleanup curl_share_init curl_share_setopt curl_share_strerror curl_slist_append curl_slist_free_all curl_strequal curl_strnequal curl_unescape curl_url curl_url_cleanup curl_url_dup curl_url_get curl_url_set curl_url_strerror

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-05_2f0b206753d27b470f7ecf57669ef5a6_avoslocker_magniber_revil

kernel32

generic