2024-06-14_e4e5d892b9b2437fd63f4652bdb0edd7_avoslocker

Sharing

Copy URL Twitter E-mail

General

Target
2024-06-14_e4e5d892b9b2437fd63f4652bdb0edd7_avoslocker
Size 1.8MB
Sample240614-nbpcgssapq
SHA256 220786b9f602ad94ef2a63633990e9160eea763fcc7622ff73a6506b87570ced
MD5 e4e5d892b9b2437fd63f4652bdb0edd7
SHA1 0c5c6ec98489eb52721d471755bac302ee288773
SHA512 8ae13eacb964e78ead2247e6eb5531efc2fb553d0f616ac9aab7053aface2f7f1ac5d1728f1449b24d7e2cadfbef792102f29e30fac160db8ed9676dd8aec799
SSDEEP 49152:SOZ0yvcF6oNEfn22cie2nVXdx14rD18LDPL/cahn:SOZ0yvcF6oyTcieCVNn4rD18Xj/caF
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2024-06-14_e4e5d892b9b2437fd63f4652bdb0edd7_avoslocker

.exe 1.8MB

2024-06-14_e4e5d892b9b2437fd63f4652bdb0edd7_avoslocker

IMPHASH 110ccb1ba17ad0ed0f86c6c5ce87af91
SHA256 220786b9f602ad94ef2a63633990e9160eea763fcc7622ff73a6506b87570ced
MD5 e4e5d892b9b2437fd63f4652bdb0edd7
SHA1 0c5c6ec98489eb52721d471755bac302ee288773
SHA512 8ae13eacb964e78ead2247e6eb5531efc2fb553d0f616ac9aab7053aface2f7f1ac5d1728f1449b24d7e2cadfbef792102f29e30fac160db8ed9676dd8aec799
SSDEEP 49152:SOZ0yvcF6oNEfn22cie2nVXdx14rD18LDPL/cahn:SOZ0yvcF6oyTcieCVNn4rD18Xj/caF
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

8f:20:83:e3:f8:e7:46:f6:e3:0c:f4:f1:0f:52:1c:56:29:e7:d9:64:18:f2:58:a3:47:51:6e:17:6f:ad:8a:4c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91440300746612636Q,CN=SHENZHEN THUNDER NETWORKING TECHNOLOGIES LTD.,O=SHENZHEN THUNDER NETWORKING TECHNOLOGIES LTD.,L=深圳市,ST=广东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e6b7b1e59cb3e5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b9bfe4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Dec 18, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

05:7c:fd:fd:f9:e7:5e:fa:00:10:3a:4b:a1:76:0d:9a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 5, 2022 - Jan 7, 2026

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

113879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\jenkins\workspace\ThunderPC\ThunderCpp_AP_Build_Pack_Thunder\thunder11_cppsrc\thunder\build\ProductRelease\ThunderStart.pdb

kernel32

LoadResource SizeofResource FindResourceW LoadLibraryW lstrcmpiW GetPrivateProfileStringW MultiByteToWideChar CloseHandle ReleaseMutex WaitForSingleObject CreateMutexW GetSystemTime FindResourceExW LockResource SystemTimeToTzSpecificLocalTime OpenFileMappingW MapViewOfFileEx UnmapViewOfFile LocalFree lstrcpyW lstrlenW GlobalAlloc GlobalUnlock GlobalLock GlobalFree OpenMutexW WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId TerminateProcess GetProcessId OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModules K32GetModuleFileNameExW SetPriorityClass WriteConsoleW CreateFileW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleCP FlushFileBuffers LoadLibraryExW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale WriteFile GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary GetCurrentThreadId LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetLastError GetTempPathW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException GetPrivateProfileStringA CreateDirectoryA ResetEvent SetEvent LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList WritePrivateProfileStringA lstrcpyA GetFileAttributesA SetStdHandle DecodePointer InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount EncodePointer WideCharToMultiByte GetVersionExA CreateFileA GetVolumeInformationA lstrcatA DeviceIoControl

user32

SetWindowPos SetTimer UpdateWindow ShowWindow PostThreadMessageW PostMessageW UnregisterClassW PeekMessageW DispatchMessageW TranslateMessage GetMessageW CharNextW GetClientRect GetWindowRect MapWindowPoints GetWindowLongW GetDesktopWindow GetParent FindWindowW GetWindow MonitorFromWindow DestroyWindow GetMonitorInfoW MessageBoxW SendMessageTimeoutW InvalidateRect EndPaint BeginPaint KillTimer IsWindowVisible UpdateLayeredWindow SendMessageW LoadCursorW SetWindowLongW IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW

gdi32

CreateCompatibleDC DeleteDC CreateDIBSection SelectObject DeleteObject

advapi32

RegEnumKeyExW RegCreateKeyExW TraceEvent GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegCloseKey

shell32

ShellExecuteExW CommandLineToArgvW SHGetSpecialFolderPathA

ole32

OleInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CreateStreamOnHGlobal

oleaut32

VarUI4FromStr

iphlpapi

GetAdaptersInfo

ws2_32

WSAStartup

shlwapi

PathAppendW PathCombineW PathFileExistsW StrStrIW StrStrW PathFindFileNameW

gdiplus

GdipGetImageHeight GdipDeleteGraphics GdipDisposeImage GdipCloneImage GdipDrawImageRect GdipGetImageWidth GdipCreateFromHDC GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipLoadImageFromStream

Sharing

General

Malware Config

Signatures

File Explorer

2024-06-14_e4e5d892b9b2437fd63f4652bdb0edd7_avoslocker

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

iphlpapi

ws2_32

shlwapi

gdiplus

generic