Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-05_d8cd2b17acd248532530df52e198b34b_avoslocker_cobalt-strike.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-07-05_d8cd2b17acd248532530df52e198b34b_avoslocker_cobalt-strike.exe
Resource
win10v2004-20240704-en
Target
2024-07-05_d8cd2b17acd248532530df52e198b34b_avoslocker_cobalt-strike
Size
297KB
MD5
d8cd2b17acd248532530df52e198b34b
SHA1
542016f084bb546d0e26e8caca081bacc8733023
SHA256
85948473bdcd908d868b1a12f548aac06bcc7e34d7099ed17e7dc0c7531d8232
SHA512
38ed0c16dc74328b1d688b9fbf2d4ad3c76be8c466d1b1c3f59e44e3ba5f0f678cdf32bc6333fc340c570afa4fe03e5ffdff0b1a56dd606f9f985766853fb5dd
SSDEEP
6144:OOjBuNc7sxuN/jzSoKzCu/rhf8W8+ypryYRBE61sXzgw:ZjB5sxuN/jzSoKzzkGQyYRBE3
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
D:\qianliu-agent\workspace\0\mq_gitlab\7538\Release\ByodProxyInstCa.pdb
Process32FirstW
OpenProcess
Process32NextW
ProcessIdToSessionId
GetCurrentProcessId
Process32First
Process32Next
DeleteFileA
GetModuleFileNameA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetModuleFileNameW
GetTempFileNameW
DeleteFileW
CopyFileA
lstrcpyA
lstrcatA
IsWow64Process
CreateToolhelp32Snapshot
GetCommandLineW
GetCommandLineA
LocalFree
SetLastError
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetExitCodeProcess
TerminateProcess
CreateProcessA
GetCurrentProcess
SetThreadLocale
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
ReadFile
GetFileAttributesExW
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
WriteConsoleW
FlushFileBuffers
GetStringTypeW
SetThreadUILanguage
GetSystemDefaultLangID
Sleep
VerifyVersionInfoW
VerSetConditionMask
GetLocalTime
WaitForSingleObject
CloseHandle
DecodePointer
RaiseException
DeleteCriticalSection
InitializeCriticalSectionEx
GetLastError
GetEnvironmentStringsW
SetEnvironmentVariableW
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateFileW
FindClose
FindFirstFileW
FindNextFileW
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
GetProcessId
LoadLibraryW
WritePrivateProfileStringW
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
MoveFileExW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetEndOfFile
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
FreeEnvironmentStringsW
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
ImpersonateLoggedOnUser
RevertToSelf
ShellExecuteExW
CommandLineToArgvW
SHCreateDirectoryExA
SHGetFolderPathA
ord165
PathRemoveFileSpecA
PathFileExistsA
PathRemoveFileSpecW
StrCpyW
StrCatW
PathAppendW
PathFileExistsW
StrRStrIW
PathFindFileNameW
WTSQueryUserToken
WTSFreeMemory
WTSEnumerateSessionsA
MiniDumpWriteDump
CertFreeCertificateContext
CertGetNameStringA
CryptStringToBinaryA
CertCreateCertificateContext
CertDuplicateCertificateContext
CertDeleteCertificateFromStore
CertOpenStore
CertEnumCertificatesInStore
CertCompareCertificate
CertCompareCertificateName
CertVerifyTimeValidity
CertAddCertificateContextToStore
CertCloseStore
RtlUnwind
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ