Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-14_ca4f3cec0dee82c2ea671d2ca7ea8f7b_avoslocker_cobalt-strike_magniber_metamorfo.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2024-06-14_ca4f3cec0dee82c2ea671d2ca7ea8f7b_avoslocker_cobalt-strike_magniber_metamorfo.exe
Resource
win10v2004-20240508-en
Target
2024-06-14_ca4f3cec0dee82c2ea671d2ca7ea8f7b_avoslocker_cobalt-strike_magniber_metamorfo
Size
936KB
MD5
ca4f3cec0dee82c2ea671d2ca7ea8f7b
SHA1
e4e4fb9b25842b410cecd9511135b2651a5fd0f4
SHA256
55af3d8bf45a723485736e515e0dabeea3b00f4949ab1271d8871a7e1a4485cf
SHA512
bc6c5819935f7a48462a9ea8e2b16987f159d661bcbe7a0c81c5a49fa7d6cefee00e95ee59bb7912b33d68205cc7f7ea519f6e575133803db75625fb36394d2e
SSDEEP
24576:2zfuQcwo2k/uBFp//cnab1r4oDCqtDHk7HpUwYwN:2zzo2k/uBP//cnmxOUIUNwN
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
D:\a\Packet\Build\UnicodeRelease\LarkLauncher\LarkLauncher.pdb
GetSystemInfo
VirtualProtect
VirtualQuery
MoveFileExW
MoveFileW
FormatMessageW
LocalFree
LoadLibraryW
GetProcAddress
OpenProcess
CreateProcessW
GetExitCodeProcess
GetCurrentProcess
GetProcessTimes
CreateEventW
WriteConsoleW
SetEndOfFile
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetConsoleCtrlHandler
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
WaitForSingleObject
SetEvent
GetLastError
CloseHandle
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
VerSetConditionMask
GetStdHandle
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFinalPathNameByHandleW
GetLogicalDriveStringsW
QueryDosDeviceW
RemoveDirectoryW
SetFileAttributesW
WriteFile
DecodePointer
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetVersionExW
GetModuleFileNameW
GetModuleHandleW
LoadResource
LockResource
SizeofResource
FindResourceW
lstrlenW
VerifyVersionInfoW
MultiByteToWideChar
WideCharToMultiByte
AllocConsole
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32EnumProcessModules
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
WaitForMultipleObjects
SetDllDirectoryW
GetUserDefaultUILanguage
HeapAlloc
GetProcessHeap
CreateDirectoryW
LocalFileTimeToFileTime
ReadFile
SetFilePointer
SetFileTime
SystemTimeToFileTime
FormatMessageA
EnterCriticalSection
LeaveCriticalSection
EncodePointer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
SetStdHandle
GetFileType
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
GetCurrentThread
LoadLibraryExA
wsprintfW
GetShellWindow
GetWindowThreadProcessId
GetSystemMetrics
UnregisterClassW
MessageBoxW
EqualSid
RegSetValueExW
RegOpenKeyExW
OpenProcessToken
AllocateAndInitializeSid
CheckTokenMembership
AdjustTokenPrivileges
FreeSid
GetTokenInformation
RegCloseKey
DuplicateTokenEx
LookupPrivilegeValueW
GetUserNameW
SHCreateDirectoryExW
ShellExecuteW
SHChangeNotify
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
WSAStartup
socket
getsockopt
closesocket
WSAGetLastError
PathIsRelativeW
PathIsNetworkPathW
SHGetValueW
SHDeleteValueW
SHDeleteKeyW
PathFindFileNameW
PathIsDirectoryW
PathFindExtensionW
SHSetValueW
StrStrIW
PathFileExistsW
CryptCATAdminReleaseContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
WTHelperProvDataFromStateData
CryptCATCatalogInfoFromContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseCatalogContext
WinVerifyTrust
CryptDecodeObjectEx
CryptStringToBinaryA
CertGetNameStringW
BCryptImportKeyPair
BCryptEncrypt
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptDestroyKey
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoInitializeSecurity
CoUninitialize
SysFreeString
VariantInit
VariantClear
CreateErrorInfo
GetErrorInfo
VariantChangeType
SetErrorInfo
SysAllocString
_cJSON_AddArrayToObject@8
_cJSON_AddBoolToObject@12
_cJSON_AddFalseToObject@8
_cJSON_AddItemReferenceToArray@8
_cJSON_AddItemReferenceToObject@12
_cJSON_AddItemToArray@8
_cJSON_AddItemToObject@12
_cJSON_AddItemToObjectCS@12
_cJSON_AddNullToObject@8
_cJSON_AddNumberToObject@16
_cJSON_AddObjectToObject@8
_cJSON_AddRawToObject@12
_cJSON_AddStringToObject@12
_cJSON_AddTrueToObject@8
_cJSON_Compare@12
_cJSON_CreateArray@0
_cJSON_CreateArrayReference@4
_cJSON_CreateBool@4
_cJSON_CreateDoubleArray@8
_cJSON_CreateFalse@0
_cJSON_CreateFloatArray@8
_cJSON_CreateIntArray@8
_cJSON_CreateNull@0
_cJSON_CreateNumber@8
_cJSON_CreateObject@0
_cJSON_CreateObjectReference@4
_cJSON_CreateRaw@4
_cJSON_CreateString@4
_cJSON_CreateStringArray@8
_cJSON_CreateStringReference@4
_cJSON_CreateTrue@0
_cJSON_Delete@4
_cJSON_DeleteItemFromArray@8
_cJSON_DeleteItemFromObject@8
_cJSON_DeleteItemFromObjectCaseSensitive@8
_cJSON_DetachItemFromArray@8
_cJSON_DetachItemFromObject@8
_cJSON_DetachItemFromObjectCaseSensitive@8
_cJSON_DetachItemViaPointer@8
_cJSON_Duplicate@8
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetErrorPtr@0
_cJSON_GetObjectItem@8
_cJSON_GetObjectItemCaseSensitive@8
_cJSON_GetStringValue@4
_cJSON_HasObjectItem@8
_cJSON_InitHooks@4
_cJSON_InsertItemInArray@12
_cJSON_IsArray@4
_cJSON_IsBool@4
_cJSON_IsFalse@4
_cJSON_IsInvalid@4
_cJSON_IsNull@4
_cJSON_IsNumber@4
_cJSON_IsObject@4
_cJSON_IsRaw@4
_cJSON_IsString@4
_cJSON_IsTrue@4
_cJSON_Minify@4
_cJSON_Parse@4
_cJSON_ParseWithOpts@12
_cJSON_Print@4
_cJSON_PrintBuffered@12
_cJSON_PrintPreallocated@16
_cJSON_PrintUnformatted@4
_cJSON_ReplaceItemInArray@12
_cJSON_ReplaceItemInObject@12
_cJSON_ReplaceItemInObjectCaseSensitive@12
_cJSON_ReplaceItemViaPointer@12
_cJSON_SetNumberHelper@12
_cJSON_Version@0
_cJSON_free@4
_cJSON_malloc@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ