2024-06-11_331a13337f21d145bdd92dff4ed8a3c5_avoslocker_magniber_revil

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-11_331a13337f21d145bdd92dff4ed8a3c5_avoslocker_magniber_revil
Size 5.3MB
Sample240611-p16thaxdkc
SHA256 227a94ba6523bf9b2fc77748c6f8c580d43f219eb8e4f4dd600335588d36be4a
MD5 331a13337f21d145bdd92dff4ed8a3c5
SHA1 4180ed229a433ae662205772476bee87a2d0cf0f
SHA512 d0148a2ff6740bdbc34456cb5f03c5c2d180aedf90638d78953b5a5a057109b2ce49da57f732c39723b9a5e94cd6a1802c098465dc569c8d741956efe1826f07
SSDEEP 98304:tkKyerff4aiY60lKLep2lxGLRY1hGM5PTLnMmnlSRDf/rOLs:t/rffhi3ip2LGRBgPTwmnlKTrj
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-06-11_331a13337f21d145bdd92dff4ed8a3c5_avoslocker_magniber_revil

.exe 5.3MB

2024-06-11_331a13337f21d145bdd92dff4ed8a3c5_avoslocker_magniber_revil

IMPHASH 42a30a7fb13cd1b6a4d76ec8a1eea11d
SHA256 227a94ba6523bf9b2fc77748c6f8c580d43f219eb8e4f4dd600335588d36be4a
MD5 331a13337f21d145bdd92dff4ed8a3c5
SHA1 4180ed229a433ae662205772476bee87a2d0cf0f
SHA512 d0148a2ff6740bdbc34456cb5f03c5c2d180aedf90638d78953b5a5a057109b2ce49da57f732c39723b9a5e94cd6a1802c098465dc569c8d741956efe1826f07
SSDEEP 98304:tkKyerff4aiY60lKLep2lxGLRY1hGM5PTLnMmnlSRDf/rOLs:t/rffhi3ip2LGRBgPTwmnlKTrj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

f8:1f:0e:09:c9:af:60:04:9e:a3:8c:d3:2d:32:33:61:d5:dc:ac:85:03:3d:c1:6f:91:9b:96:6a:60:34:d7:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Jan 31, 2024

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

f7:39:e8:45:56:3e:3c:65:47:8e:bb:9c:ac:8d:23:50:b5:b3:39:41

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Chains

Jan 31, 2024

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Serial Number

05:a8:1d:3b:96:27:0d:9a:1d:eb:07:cd:88:67:d0:a9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 14, 2021 - Oct 16, 2024

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN

Serial Number

05:a8:1d:3b:96:27:0d:9a:1d:eb:07:cd:88:67:d0:a9

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 14, 2021 - Oct 16, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1622408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_v11_i18n_20240115_branch\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb

kernel32

GetCommandLineW SetEnvironmentVariableW SetUnhandledExceptionFilter GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FindResourceExW LoadResource LockResource SizeofResource FindResourceW CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetTickCount FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryA VerSetConditionMask CreateDirectoryW GetDiskFreeSpaceExW GetTempFileNameW GetTempPathW OutputDebugStringA CreateMutexW OpenMutexW GetExitCodeProcess CreateProcessW OpenProcess GetVersionExW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte GetGeoInfoW GetUserGeoID CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetSystemTime GetSystemDirectoryW GetSystemWow64DirectoryW LoadLibraryW GetSystemPowerStatus GetUserDefaultUILanguage GetSystemDefaultLCID GetUserDefaultLCID CreateFileW GetFileAttributesW GetFileSizeEx ReadFile GetCurrentProcess TerminateProcess GetCurrentThreadId GetProcessId GetDateFormatW GetFileInformationByHandle GetFileSize SetFilePointer WriteFile GetLocalTime CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime SystemTimeToFileTime VirtualAlloc VirtualFree DeleteFileW ExitProcess FreeResource lstrcpyW GetLocaleInfoW GetUserDefaultLangID DecodePointer RaiseException InitializeCriticalSectionAndSpinCount QueryPerformanceCounter QueryPerformanceFrequency GetSystemDirectoryA SetLastError FormatMessageW MoveFileExA CompareFileTime GetSystemTimeAsFileTime GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects SleepEx GetVersionExA ExpandEnvironmentStringsA GetWindowsDirectoryA GetACP GetCurrentDirectoryW MulDiv GlobalAlloc GlobalUnlock GlobalLock LocalFree SetFileTime DuplicateHandle DosDateTimeToFileTime GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA CreateFileA DeviceIoControl CreateThread GetPrivateProfileStringW GetCurrentThread ProcessIdToSessionId CreateEventW GetFileAttributesExW SetEvent ResetEvent ReleaseSemaphore CreateSemaphoreW SystemTimeToTzSpecificLocalTime GetEnvironmentVariableW ReleaseMutex OpenFileMappingW IsDebuggerPresent OutputDebugStringW GetStringTypeW TryEnterCriticalSection SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer GetCPInfo CompareStringW LCMapStringW WaitForSingleObjectEx UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW InterlockedPushEntrySList RtlUnwind GetCommandLineA ExitThread GetDriveTypeW SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP GetTimeFormatW IsValidLocale EnumSystemLocalesW FlushFileBuffers GetFullPathNameW SetStdHandle SetEndOfFile GetTimeZoneInformation SetConsoleCtrlHandler FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW SetConsoleMode ReadConsoleA SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber FindFirstFileW FormatMessageA LockFileEx UnlockFile HeapCompact DeleteFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-11_331a13337f21d145bdd92dff4ed8a3c5_avoslocker_magniber_revil

kernel32

generic