2024-08-21_7e5ab0b559bbf6e3becf13038f7af090_avoslocker_revil

Sharing

Copy URL

Twitter E-mail

General

Target

2024-08-21_7e5ab0b559bbf6e3becf13038f7af090_avoslocker_revil
Size

6.3MB
MD5

7e5ab0b559bbf6e3becf13038f7af090
SHA1

ac1ab2bbc924a492aec9da9d179921dc8a249b28
SHA256

fb0f04cb6b07cd3b539a03b9191861c86a5c156c0d326aaa24385a11a0418897
SHA512

b482a2a2384d8108504744a1104be1092e313e006da386a2f63bb23e4805d3288d2a0a530aa62619f43da36a15d3a34992be9d4f265250f66f5674420ab0fcb4
SSDEEP

196608:TN53KAE93vDrzui/wUOnHaMirSOmoKEBitBpX4KNDZVI1:TX3KAPZa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-21_7e5ab0b559bbf6e3becf13038f7af090_avoslocker_revil

Files

2024-08-21_7e5ab0b559bbf6e3becf13038f7af090_avoslocker_revil
.exe windows:6 windows x86 arch:x86

074a531d7abb5a0e9d0a35756c0a2f19

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\ultra2\Win32\Release\ultra2\ultra2.pdb

Imports

webview2loader

GetAvailableCoreWebView2BrowserVersionString
CreateCoreWebView2EnvironmentWithOptions

comdlg32

PrintDlgW
CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW

winspool.drv

GetPrinterW
ord203
OpenPrinterW
ClosePrinter

winmm

sndPlaySoundW

kernel32

CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
CreateSemaphoreExW
ReleaseSemaphore
GetModuleHandleExW
ReleaseMutex
PostQueuedCompletionStatus
OpenSemaphoreW
DecodePointer
CreateMutexExW
DebugBreak
IsDebuggerPresent
LoadLibraryExW
CreateThread
GetQueuedCompletionStatus
SetWaitableTimer
TlsSetValue
TlsGetValue
SleepEx
SetEvent
CreateEventW
CreateIoCompletionPort
InitializeCriticalSectionAndSpinCount
QueueUserAPC
TerminateThread
WaitForMultipleObjects
GetFileSizeEx
CancelIoEx
CreateWaitableTimerW
FindClose
CreateFileMappingA
SetHandleInformation
GetOverlappedResult
CancelIo
CreateEventA
WaitNamedPipeA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetSystemDirectoryA
VirtualAlloc
VirtualProtect
VirtualFree
GetFileType
GetEnvironmentVariableW
GetACP
ReadConsoleA
ReadConsoleW
GetStringTypeW
GetLocaleInfoEx
GetCurrentDirectoryW
SystemTimeToFileTime
FindFirstFileExW
DeleteCriticalSection
SetFileInformationByHandle
GetFileInformationByHandleEx
QueryPerformanceFrequency
GlobalFree
InitOnceComplete
GetExitCodeThread
TryAcquireSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
EncodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
LoadLibraryExA
FormatMessageA
WideCharToMultiByte
GetFileSize
LockFileEx
UnlockFile
HeapCompact
GetSystemInfo
DeleteFileA
WaitForSingleObjectEx
FlushViewOfFile
ResetEvent
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
RtlUnwind
GetLastError
GetComputerNameW
GetSystemTimeAsFileTime
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateFileW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapCreate
TryEnterCriticalSection
ReadFile
AreFileApisANSI
GetVersionExW
FindNextFileW
DeleteFileW
FindFirstFileW
SetConsoleMode
GetConsoleMode
GetStdHandle
AllocConsole
SetUnhandledExceptionFilter
GetCurrentProcess
CreateFileA
GetSystemTime
GetModuleHandleA
GetProcessHeap
GetModuleFileNameA
LoadLibraryA
lstrcmpiW
CompareStringW
GetCurrentProcessId
VirtualQuery
VerSetConditionMask
VerifyVersionInfoW
GlobalReAlloc
FindResourceExW
SizeofResource
GetModuleHandleW
GetLocalTime
lstrlenW
CloseHandle
ExitProcess
lstrcmpW
CreateDirectoryW
ExitThread
ResumeThread
GlobalHandle
GlobalUnlock
GlobalLock
GlobalAlloc
GetComputerNameA
Sleep
WaitForSingleObject
CreateProcessA
GetModuleFileNameW
RaiseException
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
MultiByteToWideChar
LockResource
LoadResource
FindResourceW
FreeLibrary
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
SetConsoleCtrlHandler
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
GetProcAddress
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FormatMessageW
LocalFree
GetConsoleOutputCP
SetFilePointerEx
GetTimeZoneInformation
SetStdHandle
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
MulDiv
LoadLibraryW
TlsAlloc
TlsFree
InitOnceBeginInitialize
InitializeCriticalSectionEx
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetFileInformationByHandle
WriteConsoleW
EnumSystemLocalesW

user32

GetClipboardData
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
CreateDialogParamW
LoadIconW
SendMessageA
FindWindowA
GetProcessWindowStation
GetUserObjectInformationW
CharLowerW
MessageBeep
SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
ModifyMenuW
DrawFrameControl
FrameRect
WindowFromPoint
DrawEdge
MonitorFromPoint
TrackPopupMenuEx
PeekMessageW
RemoveMenu
IsWindowEnabled
GetClassLongW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
ChildWindowFromPoint
SetWindowPlacement
SetCursorPos
TranslateAcceleratorW
GetDlgCtrlID
GetCapture
OffsetRect
PtInRect
IsRectEmpty
GetMessagePos
LoadBitmapW
IsMenu
SetParent
CreateDialogIndirectParamW
CreatePopupMenu
AppendMenuW
GetMenuItemCount
PostQuitMessage
LoadStringA
LoadStringW
PostThreadMessageW
MessageBoxA
GetTopWindow
DeleteMenu
SetLayeredWindowAttributes
SetMenu
EnableMenuItem
CloseClipboard
OpenClipboard
DestroyCaret
ShowCaret
SetCaretPos
HideCaret
CreateCaret
SetClassLongW
CopyRect
LoadAcceleratorsW
MsgWaitForMultipleObjects
TranslateMessage
IsZoomed
wsprintfA
DrawFocusRect
CreateMenu
InsertMenuW
GetDCEx
GetMessageW
DispatchMessageW
LockWindowUpdate
GetKeyState
SetRect
GetWindowThreadProcessId
GetMenuItemID
CheckMenuItem
GetMenuStringW
GetDoubleClickTime
DestroyCursor
GetSystemMenu
SetActiveWindow
GetWindowPlacement
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuItemInfoW
CheckMenuRadioItem
EqualRect
InflateRect
SetRectEmpty
KillTimer
SetTimer
LoadImageW
wsprintfW
DrawTextW
GetWindowDC
GetSystemMetrics
SystemParametersInfoForDpi
GetSysColorBrush
MapDialogRect
RegisterWindowMessageW
IsChild
GetFocus
GetClassNameW
GetSysColor
CharNextW
RedrawWindow
CreateAcceleratorTableW
ClientToScreen
ScreenToClient
MoveWindow
InvalidateRgn
GetDesktopWindow
DestroyAcceleratorTable
DialogBoxIndirectParamW
SetWindowContextHelpId
GetClassInfoExW
RegisterClassExW
SetForegroundWindow
PostMessageW
ReleaseDC
FillRect
SystemParametersInfoW
UpdateWindow
SetScrollPos
GetScrollInfo
TrackMouseEvent
SetScrollInfo
LoadMenuW
GetSubMenu
EndPaint
BeginPaint
IntersectRect
DialogBoxParamW
GetActiveWindow
TrackPopupMenu
DestroyMenu
GetCursorPos
IsWindowVisible
CallWindowProcW
DefWindowProcW
InvalidateRect
LoadCursorW
SetCursor
ReleaseCapture
SetCapture
SendDlgItemMessageW
ShowScrollBar
IsDialogMessageW
SetWindowTextA
SetFocus
CreateWindowExW
DestroyWindow
IsWindow
SetWindowLongW
SendMessageW
AdjustWindowRectEx
GetMenu
ShowWindow
MessageBoxW
EndDialog
EnableWindow
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
MapWindowPoints
SetWindowTextW
UnregisterClassW
GetWindowLongW
SetWindowPos
GetClientRect
GetDlgItem
GetWindowTextW
DragDetect
GetWindowTextLengthW
GetDC

advapi32

CryptDestroyHash
CryptEncrypt
CryptDecrypt
RegQueryValueExW
RegCloseKey
RegCreateKeyW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptSignHashW
CryptEnumProvidersW
CryptDestroyKey
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptReleaseContext

ole32

CoTaskMemFree
CoTaskMemAlloc
OleUninitialize
CreateStreamOnHGlobal
CoCreateInstance
StringFromGUID2
CLSIDFromProgID
CLSIDFromString
OleInitialize
CoTaskMemRealloc
CoUninitialize
DoDragDrop
CoGetClassObject
OleLockRunning

shell32

SHGetFolderPathW
ShellExecuteW
DragFinish
ShellExecuteA
SHGetFileInfoW
SHGetSpecialFolderLocation
DragQueryFileW

oleaut32

VarUI4FromStr
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayAccessData
VariantInit
VariantClear
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysAllocString
SysAllocStringLen
SysStringLen
SysFreeString
DispCallFunc

shlwapi

PathAppendW
PathFindExtensionW

comctl32

ord17
ImageList_LoadImageW
ImageList_GetImageInfo
CreateStatusWindowW
ImageList_Destroy
ImageList_GetIcon
DestroyPropertySheetPage
CreatePropertySheetPageW
PropertySheetW
ImageList_GetImageCount
ImageList_AddMasked
ImageList_Draw
ImageList_Create
InitCommonControlsEx
ImageList_DrawIndirect
ImageList_ReplaceIcon
_TrackMouseEvent

uxtheme

IsAppThemed
IsThemeActive

gdi32

GetClipBox
BitBlt
CreateSolidBrush
GetDeviceCaps
GetObjectW
GetStockObject
CreateFontIndirectW
GetTextExtentPoint32W
GetObjectA
SetBkMode
SetBkColor
ExtTextOutW
SetTextAlign
SetTextColor
CreatePen
CreateDIBSection
SelectPalette
RealizePalette
GetDIBits
EndDoc
AbortDoc
EndPage
StartPage
ResetDCW
LPtoDP
CreateDCW
CreateHalftonePalette
CreateFontW
StretchDIBits
GetTextMetricsW
CreateRectRgnIndirect
CreatePatternBrush
CreateBitmap
PatBlt
CreateRectRgn
SelectClipRgn
CombineRgn
SetRectRgn
GetCurrentObject
RestoreDC
SaveDC
SetBrushOrgEx
MoveToEx
LineTo
Polygon
Polyline
GetClipRgn
IntersectClipRect
OffsetWindowOrgEx
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DPtoLP
SetWindowOrgEx
DeleteDC
SetViewportOrgEx
StartDocW
DeleteObject

msimg32

GradientFill

ws2_32

send
WSAStartup
WSAGetLastError
htons
WSASetLastError
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
ntohs
getsockopt
inet_addr
gethostbyname
socket
setsockopt
WSAStringToAddressW
connect
closesocket
select
getsockname
inet_ntop
WSACleanup
ioctlsocket
recv
accept
__WSAFDIsSet
WSARecv
WSASocketW
bind
shutdown
WSASend
listen
htonl
ntohl

mswsock

GetAcceptExSockaddrs
AcceptEx

bcrypt

BCryptGenRandom

gdiplus

GdipLoadImageFromFile
GdipLoadImageFromFileICM
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipSaveImageToFile
GdipDrawImage
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipCreateFontFromLogfontA
GdipSetTextRenderingHint
GdipSaveGraphics
GdipScaleWorldTransform
GdipRestoreGraphics
GdipGetPropertySize
GdipGetAllPropertyItems
GdipImageRotateFlip
GdipDrawImageRect
GdipCreatePath
GdipDeletePath
GdipAddPathLine
GdipAddPathArc
GdipClosePathFigure
GdipFillPath
GdipSetClipRect
GdipDrawImageRectI
GdipResetClip
GdipFillPolygon
GdipCloneImage
GdipCreateFontFromDC
GdipCreateFromHWND
GdipSetImageAttributesNoOp
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDrawLineI
GdipDrawImageRectRect
GdipGetImageHeight
GdipGetImageWidth
GdipDrawLine
GdipFillRectangleI
GdipMeasureString
GdipDrawRectangle
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipSetStringFormatTrimming
GdipDrawString
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipFillRectangle
GdipDeleteGraphics
GdipCreateFromHDC
GdipFlush
GdipStringFormatGetGenericDefault
GdipDisposeImage
GdipCreatePen1
GdipDeletePen
GdipCreateSolidFill
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCloneBrush
GdipCreateLineBrush

winhttp

WinHttpSetOption
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpConnect
WinHttpReadData
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpCrackUrl

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 840KB - Virtual size: 839KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 167KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 922KB - Virtual size: 921KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

074a531d7abb5a0e9d0a35756c0a2f19

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

webview2loader

comdlg32

winspool.drv

winmm

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

comctl32

uxtheme

gdi32

msimg32

ws2_32

mswsock

bcrypt

gdiplus

winhttp

crypt32

Sections

.text Size: 4.2MB - Virtual size: 4.2MB

.rdata Size: 840KB - Virtual size: 839KB

.data Size: 167KB - Virtual size: 196KB

.rsrc Size: 922KB - Virtual size: 921KB

.reloc Size: 196KB - Virtual size: 196KB

.text
Size: 4.2MB - Virtual size: 4.2MB

.rdata
Size: 840KB - Virtual size: 839KB

.data
Size: 167KB - Virtual size: 196KB

.rsrc
Size: 922KB - Virtual size: 921KB

.reloc
Size: 196KB - Virtual size: 196KB