2024-08-21_f6ad63d5748c0e0f6a029195e509c950_avoslocker_metamorfo_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-21_f6ad63d5748c0e0f6a029195e509c950_avoslocker_metamorfo_revil
Size

3.0MB
MD5

f6ad63d5748c0e0f6a029195e509c950
SHA1

0255665a0c6ffd47e8499f27f1ea2cf7dc1fe744
SHA256

fa58b49a5c79744690cc05fe4a8d3543206cef399da271af8c953985421a3889
SHA512

9d9745d2766ecc93b66f7b4aa88e8953cbb512b8301d2c772fe6b968dd5f59cc73cf8b7a9efdeb76abffcc93f894c4217fb0e637392a206539d5d0084ab4324e
SSDEEP

49152:E/qCSmmE7yrvlyhP0UXnBxpgzes+F5RN7PdTW+jPg/N1zx8dYtGVVWZ:E/qCSm+iP0KnBxpgaz5zLU/N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-21_f6ad63d5748c0e0f6a029195e509c950_avoslocker_metamorfo_revil

Files

2024-08-21_f6ad63d5748c0e0f6a029195e509c950_avoslocker_metamorfo_revil
.exe windows:6 windows x86 arch:x86

775a4ed7a51a4279fb2c4232b93ce5e7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

accept
listen
recvfrom
sendto
freeaddrinfo
gethostname
gethostbyname
getaddrinfo
WSAIoctl
setsockopt
ntohs
WSACleanup
htons
getsockopt
getsockname
getpeername
connect
getnameinfo
shutdown
WSAGetLastError
socket
__WSAFDIsSet
select
WSASetLastError
recv
send
bind
ioctlsocket
closesocket
WSAStartup

kernel32

FindNextFileA
lstrcmpA
FindFirstFileA
GetLongPathNameA
MoveFileA
MultiByteToWideChar
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDriveStringsA
GetLogicalDrives
GetCurrentProcess
GetModuleHandleA
GetProcAddress
LocalFree
OutputDebugStringA
WriteConsoleW
FreeLibrary
FormatMessageW
lstrcpynA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
lstrlenA
GetModuleFileNameA
SetEndOfFile
SetFilePointer
CopyFileA
Sleep
GetTickCount
WaitForSingleObject
TerminateThread
CreateThread
CloseHandle
GetSystemTime
GetEnvironmentVariableW
FormatMessageA
PeekNamedPipe
ReadFile
GetStdHandle
GetFileType
WaitForMultipleObjects
ExpandEnvironmentStringsA
QueryPerformanceCounter
VerifyVersionInfoW
QueryPerformanceFrequency
GetSystemDirectoryW
GetModuleHandleW
LoadLibraryW
VerSetConditionMask
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetProcessHeap
DeleteCriticalSection
DecodePointer
RtlUnwind
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
HeapFree
ExitProcess
LockResource
SizeofResource
LoadResource
FindResourceA
lstrcatA
GetEnvironmentVariableA
Process32Next
Process32First
CreateToolhelp32Snapshot
OpenMutexA
WideCharToMultiByte
DeviceIoControl
SleepEx
SetLastError
lstrcmpiA
lstrcpyW
CreateProcessA
LoadLibraryA
ConvertThreadToFiber
ConvertFiberToThread
FindFirstFileW
CreateFiber
DeleteFiber
CreateFileMappingA
CreateFileA
GetLastError
DeleteFileA
lstrcpyA
SetConsoleMode
ReadConsoleA
FindClose
TryEnterCriticalSection
GetCurrentThreadId
GetStringTypeW
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
IsDebuggerPresent
OutputDebugStringW
GetACP
GlobalLock
GlobalUnlock
GetFileSize
GetCurrentDirectoryA
MulDiv
FreeResource
GlobalAlloc
WriteFile
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
CreateDirectoryA
GetCurrentProcessId
IsDBCSLeadByte
GetLocalTime
InterlockedIncrement
InterlockedDecrement
SetEvent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
GetCommandLineA
ExitThread
GetModuleHandleExW
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileAttributesExW
GetFileSizeEx
MoveFileExW
CreateDirectoryW
GetTimeZoneInformation
GetCurrentDirectoryW
GetFullPathNameW
SetConsoleCtrlHandler
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
SwitchToFiber

user32

GetWindowLongA
SetWindowLongA
GetParent
GetWindow
LoadCursorA
LoadImageA
MonitorFromWindow
GetMonitorInfoA
IsIconic
SetWindowRgn
ScreenToClient
OffsetRect
SetCursor
InflateRect
UnionRect
DestroyWindow
IsWindowVisible
CharNextA
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
SetTimer
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetCursorPos
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
CharPrevA
DrawTextA
DrawTextW
FillRect
SetRect
UpdateLayeredWindow
MoveWindow
GetWindowRgn
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuA
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
EqualRect
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
CreateAcceleratorTableA
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextA
MapVirtualKeyExA
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
MessageBoxA
GetDesktopWindow
PostQuitMessage
GetWindowRect
GetClientRect
IsZoomed
LoadStringW
wsprintfA
GetPropA
SetPropA
GetSystemMetrics
EnableWindow
SetFocus
SetWindowPos
ShowWindow
IsWindow
CreateWindowExA
GetClassInfoExA
RegisterClassExA
RegisterClassA
CallWindowProcA
DefWindowProcA
PostMessageA
SendMessageA
DispatchMessageA
TranslateMessage
GetMessageA
IsWindowEnabled

gdi32

CreateRectRgnIndirect
DeleteObject
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectA
CreatePen
DeleteDC
GetDeviceCaps
GetStockObject
AddFontMemResourceEx
RemoveFontMemResourceEx
Rectangle
RestoreDC
SaveDC
SelectObject
CloseEnhMetaFile
CreateEnhMetaFileA
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsA
SetWindowOrgEx
CombineRgn
CreatePenIndirect
CreateSolidBrush
GetCharABCWidthsA
GetClipBox
GetTextExtentPoint32A
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
CreateDIBSection
MoveToEx
TextOutA
GdiFlush
CreateRectRgn
PtInRegion
CreatePatternBrush
GetTextExtentPointA
GetBitmapBits
SetBitmapBits
CreateRoundRectRgn
GetObjectA

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryInfoKeyA
RegEnumKeyA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA
SHGetMalloc
DragQueryFileA

ole32

CLSIDFromString
ReleaseStgMedium
CreateStreamOnHGlobal
OleDuplicateData
DoDragDrop
RegisterDragDrop
CoInitialize
CoCreateInstance
CoUninitialize
CLSIDFromProgID
OleLockRunning

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString
SysAllocStringLen

shlwapi

PathAppendA
PathRemoveFileSpecA
StrCmpNIA
PathCombineA
StrToIntA
PathFindExtensionA
PathRemoveBackslashA
SHGetValueA
SHSetValueA
PathFileExistsW
StrStrIA
PathStripPathA
wnsprintfA
PathRemoveExtensionA
PathFileExistsA
StrFormatByteSizeA

sensapi

IsNetworkAlive

wldap32

ord133
ord79
ord147
ord301
ord142
ord167
ord127
ord27
ord26
ord118
ord41
ord208
ord216
ord14
ord46
ord219
ord145

crypt32

CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx

gdiplus

GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipFillRectangleI
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipTranslateWorldTransform
GdipRotateWorldTransform

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 654KB - Virtual size: 653KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

775a4ed7a51a4279fb2c4232b93ce5e7

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

sensapi

wldap32

crypt32

comctl32

gdiplus

imm32

Sections

.text Size: 2.2MB - Virtual size: 2.2MB

.rdata Size: 654KB - Virtual size: 653KB

.data Size: 34KB - Virtual size: 61KB

.rsrc Size: 29KB - Virtual size: 29KB

.reloc Size: 118KB - Virtual size: 118KB

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 654KB - Virtual size: 653KB

.data
Size: 34KB - Virtual size: 61KB

.rsrc
Size: 29KB - Virtual size: 29KB

.reloc
Size: 118KB - Virtual size: 118KB