2024-06-19_755773831c9e12037943c7f0d1ca8711_avoslocker_cobalt-strike

Sharing

Copy URL Twitter E-mail

General

Target

2024-06-19_755773831c9e12037943c7f0d1ca8711_avoslocker_cobalt-strike
Size

817KB
MD5

755773831c9e12037943c7f0d1ca8711
SHA1

8f206a2119b8fb4267127caf615f5a95f52b3791
SHA256

0ae7ed4bd2fdc42b1e674e4287a28d12aee069233377da02b1bd676041280f61
SHA512

92d443d4c8a7877ace1b0a7950d1e699f1eb78e37aa66bf397bb14aae7afeecf4c1183fa8a6e7c0defb60aae2ae6a0e8ef8f5b710b221a83a7e0fb9684964e1b
SSDEEP

24576:lkedhWYrdNQGji14WzovvYSNhZOLPr4b/OvJYAwA:lkedrdNQGmZ6zhZcPEb2JYAwA

Score

1^/10

Malware Config

Signatures

Files

2024-06-19_755773831c9e12037943c7f0d1ca8711_avoslocker_cobalt-strike
.exe windows:6 windows x86 arch:x86

558928dfd479ee25ee4be44709ad4cdf

Code Sign

53:76:34:0a:02:d7:1b:41:2c:8e:8e:b9:41:7d:44:1c
Certificate

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

11/06/2024, 05:40

Not After

11/06/2027, 05:40

Subject

CN=Bogdan Blagoev Sharkov,O=Bogdan Blagoev Sharkov,L=Sofia,C=BG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02/11/2023, 08:32

Not After

30/10/2034, 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:be:46:b5:4e:31:26:d3:a8:52:9a:14:66:77:e9:2e:47:a5:52:da:d8:2b:94:25:42:f6:42:ec:ba:64:8c:92
Signer

Actual PE Digest

48:be:46:b5:4e:31:26:d3:a8:52:9a:14:66:77:e9:2e:47:a5:52:da:d8:2b:94:25:42:f6:42:ec:ba:64:8c:92

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Bobo\GIT\APOConfig\Release\ClownfishVoicechanger.pdb

Imports

bcrypt

BCryptOpenAlgorithmProvider
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptHashData
BCryptCreateHash
BCryptGetProperty

wininet

InternetQueryDataAvailable
HttpOpenRequestA
HttpQueryInfoW
InternetQueryOptionW
InternetOpenA
InternetCloseHandle
HttpSendRequestA
InternetConnectA
InternetSetOptionW
InternetReadFile
HttpAddRequestHeadersA

shlwapi

PathFileExistsW

ws2_32

freeaddrinfo
WSACleanup
__WSAFDIsSet
closesocket
gethostbyname
select
shutdown
getaddrinfo
WSAStartup
inet_addr
gethostbyaddr
send
socket
connect
WSAAddressToStringW
recv
htons

kernel32

FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
HeapFree
GetCurrentProcess
LocalAlloc
HeapAlloc
LocalFree
GetProcessHeap
MultiByteToWideChar
FormatMessageW
CreateDirectoryW
ReadFile
FindFirstFileW
CreateNamedPipeA
EnterCriticalSection
FindNextFileW
lstrlenW
WriteFile
lstrcpynW
GetUserDefaultUILanguage
LeaveCriticalSection
InitializeCriticalSection
CreateMutexW
InitializeCriticalSectionEx
FindClose
GetLocaleInfoW
WaitForSingleObject
CreateFileW
GetVersionExW
DisconnectNamedPipe
Sleep
GetLastError
GetCurrentThread
LoadLibraryA
ExitProcess
CloseHandle
LoadLibraryW
CreateThread
DecodePointer
GetProcAddress
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetModuleHandleW
FreeLibrary
CopyFileW
WideCharToMultiByte
ConnectNamedPipe
SetUnhandledExceptionFilter
FlushFileBuffers
GetExitCodeProcess
GetModuleFileNameA
SetLastError
OutputDebugStringA
GetEnvironmentVariableW
GetEnvironmentVariableA
GetFileAttributesW
SuspendThread
GetCurrentDirectoryA
ResumeThread
GetVersionExA
GetThreadContext
ReadProcessMemory
CreateEventExW
WaitForMultipleObjects
SetEvent
ResetEvent
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RaiseException
RtlUnwind
GetStdHandle
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
EncodePointer
HeapReAlloc
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
GetModuleHandleExW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
HeapSize
WriteConsoleW
DeleteFileW
SetEndOfFile
InitializeCriticalSectionAndSpinCount

user32

MessageBeep
RegisterClassExW
GetWindowPlacement
LoadAcceleratorsW
TrackPopupMenu
LoadStringW
GetSubMenu
ShowWindow
IsWindow
GetAsyncKeyState
OffsetRect
DispatchMessageW
SetTimer
CopyRect
SwitchToThisWindow
SetMenuItemInfoW
GetWindowTextA
SetWindowPlacement
SetMenuInfo
SetWindowTextA
SendDlgItemMessageW
DialogBoxIndirectParamW
MoveWindow
SetMenu
IsDlgButtonChecked
UnhookWindowsHookEx
DestroyMenu
SetFocus
TranslateAcceleratorW
FindWindowW
LoadCursorW
SendMessageA
SetWindowsHookExW
RemoveMenu
CheckMenuItem
GetDlgItem
AppendMenuW
SetRect
KillTimer
PostQuitMessage
GetDesktopWindow
GetParent
DialogBoxParamW
UpdateWindow
SetForegroundWindow
GetWindowLongW
GetMessageW
GetMenuItemInfoW
DefWindowProcW
LoadImageW
GetCursorPos
BeginPaint
EndPaint
EnableWindow
GetWindowTextW
ModifyMenuW
AdjustWindowRectEx
LoadMenuW
PostMessageW
GetWindowRect
DestroyWindow
SetWindowPos
MessageBoxW
GetMenuItemCount
CreateWindowExW
SendMessageW
CallNextHookEx
EndDialog
MessageBoxA
SetWindowTextW
TranslateMessage

gdi32

GetStockObject
SetTextColor
SetBkMode
GetObjectW
DeleteObject
CreateFontIndirectW
CreateSolidBrush

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

GetUserNameA
SetEntriesInAclA
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
RegQueryValueExW
RegDeleteValueW
RegOpenKeyExW
InitializeSecurityDescriptor
RegSetValueExW
RegEnumKeyExW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
CryptReleaseContext
CryptGetHashParam
RegCreateKeyW

shell32

SHBrowseForFolderW
ShellExecuteExW
SHGetPathFromIDListW
SHFileOperationW
SHGetFolderPathW
Shell_NotifyIconW
ShellExecuteW

ole32

CoTaskMemAlloc
CoInitializeEx
PropVariantClear
OleInitialize
CoUninitialize
OleUninitialize
CoTaskMemFree
CLSIDFromString
CoCreateInstance

oleaut32

VariantInit
VariantClear

version

GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoA

Sections

.text
Size: 532KB - Virtual size: 531KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 203KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

558928dfd479ee25ee4be44709ad4cdf

Code Sign

53:76:34:0a:02:d7:1b:41:2c:8e:8e:b9:41:7d:44:1cCertificate

Extended Key Usages

Key Usages

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39Certificate

Extended Key Usages

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

48:be:46:b5:4e:31:26:d3:a8:52:9a:14:66:77:e9:2e:47:a5:52:da:d8:2b:94:25:42:f6:42:ec:ba:64:8c:92Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcrypt

wininet

shlwapi

ws2_32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

version

Sections

.text Size: 532KB - Virtual size: 531KB

.rdata Size: 203KB - Virtual size: 202KB

.data Size: 6KB - Virtual size: 62KB

.rsrc Size: 21KB - Virtual size: 20KB

.reloc Size: 44KB - Virtual size: 44KB

53:76:34:0a:02:d7:1b:41:2c:8e:8e:b9:41:7d:44:1c
Certificate

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

48:be:46:b5:4e:31:26:d3:a8:52:9a:14:66:77:e9:2e:47:a5:52:da:d8:2b:94:25:42:f6:42:ec:ba:64:8c:92
Signer

.text
Size: 532KB - Virtual size: 531KB

.rdata
Size: 203KB - Virtual size: 202KB

.data
Size: 6KB - Virtual size: 62KB

.rsrc
Size: 21KB - Virtual size: 20KB

.reloc
Size: 44KB - Virtual size: 44KB