2024-06-13_1ac4bdff94046f98ab7c17cbb96ea98b_avoslocker_cobalt-strike

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-13_1ac4bdff94046f98ab7c17cbb96ea98b_avoslocker_cobalt-strike
Size 495KB
Sample240613-fbxpvsyarl
SHA256 1f69ad54f28e4f9054e17e4670f244464b013008f71ad3aa145593d1770926ad
MD5 1ac4bdff94046f98ab7c17cbb96ea98b
SHA1 7a451661d4bf1c4f8847c6fb7be6be19e33ed1ab
SHA512 5795b73a54830f2ed7824cbefd6bb8ce41e072271a4ecf66fd88190708215cc5ca2c506c482db782c847ba51b196bae38446492874411a3210d949396bde2605
SSDEEP 6144:87WQ0j4ltziolIGlnE2deW3rlBu0R+J5JlLgPYfq8ZF02IlLZDj0nXes2I:ci4lZiop3fu0R+J5JlLgPbDj0nF2I
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-06-13_1ac4bdff94046f98ab7c17cbb96ea98b_avoslocker_cobalt-strike

.exe 495KB

2024-06-13_1ac4bdff94046f98ab7c17cbb96ea98b_avoslocker_cobalt-strike

IMPHASH a1b18b72067d74780ce7b8afa1409733
SHA256 1f69ad54f28e4f9054e17e4670f244464b013008f71ad3aa145593d1770926ad
MD5 1ac4bdff94046f98ab7c17cbb96ea98b
SHA1 7a451661d4bf1c4f8847c6fb7be6be19e33ed1ab
SHA512 5795b73a54830f2ed7824cbefd6bb8ce41e072271a4ecf66fd88190708215cc5ca2c506c482db782c847ba51b196bae38446492874411a3210d949396bde2605
SSDEEP 6144:87WQ0j4ltziolIGlnE2deW3rlBu0R+J5JlLgPYfq8ZF02IlLZDj0nXes2I:ci4lZiop3fu0R+J5JlLgPbDj0nF2I
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

ed:a7:1c:a2:8e:48:a1:15:f7:7e:eb:40:01:77:89:63:37:07:58:a7:2b:f4:99:59:95:5e:8e:e8:b9:03:7e:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Internet Testing Systems\, LLC,O=Internet Testing Systems\, LLC,L=Baltimore,ST=Maryland,C=US

Chains

Jun 11, 2024

CN=Internet Testing Systems\, LLC,O=Internet Testing Systems\, LLC,L=Baltimore,ST=Maryland,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Internet Testing Systems\, LLC,O=Internet Testing Systems\, LLC,L=Baltimore,ST=Maryland,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Internet Testing Systems\, LLC,O=Internet Testing Systems\, LLC,L=Baltimore,ST=Maryland,C=US

Serial Number

0c:57:09:eb:53:17:bf:27:b8:a9:6e:a2:f1:4c:6f:a4

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 1, 2023 - Jul 31, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

20471

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\VSS\Solutions\CBootstrap\VerifyAndLaunch\Release\VerifyAndLaunch.pdb

wininet

InternetCanonicalizeUrlA InternetOpenUrlA InternetOpenA InternetReadFile HttpQueryInfoA

shlwapi

PathRemoveExtensionW PathFindFileNameW PathFileExistsW

kernel32

HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GlobalAlloc GlobalFree SizeofResource WriteFile FindResourceA CreateFileW GetLastError LockResource DeleteFileW CloseHandle ReadFile WideCharToMultiByte Process32First TerminateProcess GetModuleFileNameW GetTempPathW WaitForSingleObject OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetVersionExA DeleteFileA Process32Next SetFilePointerEx GetFileSizeEx GetProcessHeap ReadConsoleW SetEndOfFile DecodePointer LoadResource IsDebuggerPresent LCMapStringW GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WriteConsoleW GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW MoveFileExW GetStdHandle HeapAlloc HeapFree GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP

user32

MessageBoxW wsprintfA

advapi32

RegQueryValueExA RegSetValueExA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteW SHCreateDirectoryExW SHGetSpecialFolderPathW ShellExecuteExW

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitialize

oleaut32

SysFreeString SysAllocStringLen VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-13_1ac4bdff94046f98ab7c17cbb96ea98b_avoslocker_cobalt-strike

wininet

shlwapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic