2024-08-21_b2f59e79ad3d40b2566dd8165af42a7e_avoslocker_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-21_b2f59e79ad3d40b2566dd8165af42a7e_avoslocker_revil
Size

5.3MB
MD5

b2f59e79ad3d40b2566dd8165af42a7e
SHA1

33a0a5f4ff84fcf2d11965a1f1df939813144b6c
SHA256

bcff4f3c01d7ff29cf51c9504b73ebb2129caae8ae912cbe09ec88901514641b
SHA512

2800d8c48907744565de08e79c881136b3837292d64af60f76659bc7211ccbc522cd7079912fc73b1ac3e4c7163295bcb684049020084bfda175aa1198665d09
SSDEEP

49152:UTyh9U8sRxwz+z6DFp47McoDHRTPErMy8Lzo/qiYyezXP4yP4QoruIhwOeb7r+p+:UTyh9iS+gp4wcodTPWb8LzojryM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-08-21_b2f59e79ad3d40b2566dd8165af42a7e_avoslocker_revil

Files

2024-08-21_b2f59e79ad3d40b2566dd8165af42a7e_avoslocker_revil
.exe windows:6 windows x86 arch:x86

e40c0b551669732a9f2bfeba3891aad6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\ultra_763\Win32\Release\ultra2\ultra2.pdb

Imports

webview2loader

GetAvailableCoreWebView2BrowserVersionString
CreateCoreWebView2EnvironmentWithOptions

ws2_32

WSACleanup
gethostbyname
inet_addr
WSAStartup
send
WSASetLastError
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
htonl
ntohs
WSAGetLastError
getsockopt
getsockname
recv
select
ioctlsocket
closesocket
connect
htons
setsockopt
shutdown
socket

comdlg32

PrintDlgW
CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW

winspool.drv

ClosePrinter
GetPrinterW
ord203
OpenPrinterW

winmm

sndPlaySoundW

kernel32

WaitForSingleObjectEx
DeleteFileA
GetSystemInfo
HeapCompact
UnlockFile
LockFileEx
GetFileSize
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTimeAsFileTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
CreateSemaphoreExW
ReleaseSemaphore
GetModuleHandleExW
ReleaseMutex
OpenSemaphoreW
DecodePointer
CreateMutexExW
DebugBreak
IsDebuggerPresent
LoadLibraryExW
CreateThread
FindClose
SetHandleInformation
GetOverlappedResult
CancelIo
SleepEx
CreateEventA
CreateFileMappingA
WaitNamedPipeA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemDirectoryA
VirtualAlloc
VirtualProtect
VirtualFree
GetFileType
GetEnvironmentVariableW
GetACP
OutputDebugStringW
PeekNamedPipe
ReadConsoleA
ReadConsoleW
GetModuleFileNameW
GetLocaleInfoEx
GetCurrentDirectoryW
lstrcmpW
FindFirstFileExW
GetFileInformationByHandle
SetFileInformationByHandle
GetFileInformationByHandleEx
InitOnceBeginInitialize
InitOnceComplete
GetExitCodeThread
TryAcquireSRWLockExclusive
EncodePointer
LCMapStringEx
WakeAllConditionVariable
SleepConditionVariableSRW
CompareStringEx
GetCPInfo
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
LoadLibraryExA
SystemTimeToTzSpecificLocalTime
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateFileW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapCreate
TryEnterCriticalSection
ReadFile
AreFileApisANSI
GetModuleFileNameA
GetVersionExW
FindNextFileW
DeleteFileW
FindFirstFileW
SetConsoleMode
GetConsoleMode
GetStdHandle
AllocConsole
SetUnhandledExceptionFilter
GetSystemTime
GetCurrentProcess
CreateFileA
LoadLibraryA
lstrcmpiW
CompareStringW
GetCurrentProcessId
VirtualQuery
VerSetConditionMask
VerifyVersionInfoW
GlobalReAlloc
FindResourceExW
SizeofResource
GetModuleHandleW
GetLocalTime
FileTimeToSystemTime
lstrlenW
FormatMessageW
LocalFree
CloseHandle
ExitProcess
Sleep
MulDiv
GlobalFree
RaiseException
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
MultiByteToWideChar
LockResource
LoadResource
FindResourceW
FreeLibrary
GetProcAddress
LoadLibraryW
InitializeCriticalSectionEx
DeleteCriticalSection
GetLastError
GetComputerNameW
GetProcessHeap
HeapAlloc
HeapFree
GlobalHandle
GlobalUnlock
GlobalLock
GlobalAlloc
WaitForSingleObject
CreateDirectoryW
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
RtlUnwind
InitializeCriticalSectionAndSpinCount
ExitThread
ResumeThread
FreeLibraryAndExitThread
HeapReAlloc
SetConsoleCtrlHandler
CreateProcessA
HeapSize
HeapDestroy
GetCommandLineW
GetStringTypeW
GetDriveTypeW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
SetStdHandle
GetTimeZoneInformation
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
GetCommandLineA

user32

LoadAcceleratorsW
CopyRect
DragDetect
DestroyCursor
GetDoubleClickTime
GetMenuStringW
CheckMenuItem
SetClassLongW
CreateCaret
HideCaret
SetCaretPos
ShowCaret
DestroyCaret
OpenClipboard
CloseClipboard
GetClipboardData
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
CreateDialogParamW
SendMessageA
FindWindowA
GetProcessWindowStation
GetUserObjectInformationW
DeferWindowPos
BeginDeferWindowPos
ChildWindowFromPoint
SetWindowPlacement
SetCursorPos
TranslateAcceleratorW
GetDlgCtrlID
GetCapture
OffsetRect
PtInRect
IsRectEmpty
GetMessagePos
LoadBitmapW
IsMenu
SetParent
CreateDialogIndirectParamW
CreatePopupMenu
AppendMenuW
GetMenuItemCount
PostQuitMessage
LoadStringA
CreateMenu
PostThreadMessageW
MsgWaitForMultipleObjects
GetTopWindow
DeleteMenu
SetLayeredWindowAttributes
SetMenu
EnableMenuItem
GetSystemMenu
SetActiveWindow
GetWindowPlacement
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuItemInfoW
CheckMenuRadioItem
EqualRect
InflateRect
SetRectEmpty
KillTimer
SetTimer
LoadImageW
wsprintfW
DrawTextW
GetWindowDC
InsertMenuW
GetDCEx
GetMessageW
DispatchMessageW
LockWindowUpdate
EndDeferWindowPos
SetRect
GetWindowThreadProcessId
TranslateMessage
GetMenuItemID
GetKeyState
CharLowerW
MessageBeep
SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
ModifyMenuW
DrawFrameControl
FrameRect
WindowFromPoint
DrawEdge
MonitorFromPoint
TrackPopupMenuEx
PeekMessageW
RemoveMenu
IsWindowEnabled
GetClassLongW
IsZoomed
wsprintfA
MessageBoxA
DrawFocusRect
GetSystemMetrics
SystemParametersInfoForDpi
GetSysColorBrush
MapDialogRect
RegisterWindowMessageW
IsChild
GetFocus
GetClassNameW
GetSysColor
CharNextW
RedrawWindow
CreateAcceleratorTableW
ClientToScreen
ScreenToClient
MoveWindow
InvalidateRgn
GetDesktopWindow
DestroyAcceleratorTable
DialogBoxIndirectParamW
SetWindowContextHelpId
GetClassInfoExW
LoadStringW
RegisterClassExW
SetForegroundWindow
PostMessageW
ReleaseDC
GetDC
FillRect
SystemParametersInfoW
UpdateWindow
GetScrollInfo
TrackMouseEvent
SetScrollInfo
LoadMenuW
GetSubMenu
EndPaint
BeginPaint
IntersectRect
DialogBoxParamW
GetActiveWindow
TrackPopupMenu
DestroyMenu
GetCursorPos
IsWindowVisible
CallWindowProcW
DefWindowProcW
InvalidateRect
LoadCursorW
SetCursor
ReleaseCapture
SetCapture
SendDlgItemMessageW
ShowScrollBar
IsDialogMessageW
SetWindowTextA
SetFocus
CreateWindowExW
DestroyWindow
IsWindow
SetWindowLongW
SendMessageW
AdjustWindowRectEx
GetMenu
ShowWindow
MessageBoxW
EndDialog
EnableWindow
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
GetParent
MapWindowPoints
SetWindowTextW
UnregisterClassW
GetWindowLongW
SetWindowPos
GetClientRect
GetDlgItem
GetWindowTextW
GetWindowTextLengthW
SetScrollPos

advapi32

CryptHashData
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
CryptEncrypt
CryptDecrypt
RegQueryValueExW
RegCloseKey
RegCreateKeyW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptSignHashW
CryptEnumProvidersW
CryptCreateHash
CryptAcquireContextW
CryptDeriveKey

ole32

OleUninitialize
CoTaskMemAlloc
CoTaskMemFree
StringFromGUID2
OleLockRunning
CoCreateInstance
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
CoTaskMemRealloc
CoUninitialize
DoDragDrop
CreateStreamOnHGlobal

shell32

SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetFolderPathW
SHGetFolderPathA
ShellExecuteW
DragFinish
DragQueryFileW
ShellExecuteA

oleaut32

SysStringLen
VarUI4FromStr
SafeArrayGetUBound
SafeArrayGetLBound
DispCallFunc
SafeArrayUnaccessData
SafeArrayAccessData
VariantInit
VariantClear
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SysAllocString
SysAllocStringLen
SysFreeString

shlwapi

PathFindExtensionW
PathAppendA
PathAppendW

comctl32

ord17
ImageList_LoadImageW
ImageList_GetImageInfo
CreateStatusWindowW
ImageList_Destroy
ImageList_GetIcon
DestroyPropertySheetPage
CreatePropertySheetPageW
PropertySheetW
ImageList_GetImageCount
ImageList_AddMasked
ImageList_Draw
ImageList_Create
InitCommonControlsEx
ImageList_DrawIndirect
ImageList_ReplaceIcon
_TrackMouseEvent

uxtheme

IsAppThemed
IsThemeActive

gdi32

DeleteObject
DeleteDC
SetWindowOrgEx
DPtoLP
SelectObject
CreateCompatibleBitmap
LPtoDP
CreateCompatibleDC
GetClipBox
BitBlt
CreateSolidBrush
GetDeviceCaps
GetObjectW
GetStockObject
CreateFontIndirectW
GetTextExtentPoint32W
GetObjectA
SetBkMode
SetBkColor
ExtTextOutW
SetTextAlign
SetTextColor
CreatePen
CreateDIBSection
SelectPalette
RealizePalette
GetDIBits
EndDoc
AbortDoc
EndPage
StartPage
ResetDCW
StartDocW
CreateDCW
CreateHalftonePalette
CreateFontW
StretchDIBits
GetTextMetricsW
CreateRectRgnIndirect
CreatePatternBrush
CreateBitmap
PatBlt
CreateRectRgn
SelectClipRgn
CombineRgn
SetRectRgn
GetCurrentObject
RestoreDC
SaveDC
SetBrushOrgEx
MoveToEx
LineTo
Polygon
Polyline
GetClipRgn
IntersectClipRect
OffsetWindowOrgEx
SetViewportOrgEx

msimg32

GradientFill

gdiplus

GdipGetPropertySize
GdipGetAllPropertyItems
GdipImageRotateFlip
GdipDrawImageRect
GdipCreatePath
GdipDeletePath
GdipAddPathLine
GdipAddPathArc
GdipClosePathFigure
GdipFillPath
GdipSetClipRect
GdipStringFormatGetGenericDefault
GdipRestoreGraphics
GdipFillPolygon
GdipSetTextRenderingHint
GdipCreateLineBrush
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImage
GdipSaveImageToFile
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromFileICM
GdipScaleWorldTransform
GdipResetClip
GdipLoadImageFromFile
GdipDrawImageRectI
GdipCloneImage
GdipDisposeImage
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipCreateFromHWND
GdipSetImageAttributesNoOp
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipDrawLineI
GdipDrawImageRectRect
GdipGetImageHeight
GdipGetImageWidth
GdipDrawLine
GdipCreatePen1
GdipSaveGraphics
GdipDeletePen
GdipCreateSolidFill
GdipDeleteBrush
GdipFree
GdipAlloc
GdipCloneBrush
GdipFlush
GdipCreateFromHDC
GdipDeleteGraphics
GdipFillRectangle
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatLineAlign
GdipFillRectangleI
GdipMeasureString
GdipDrawRectangle
GdipDeleteFont
GdipCreateFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipSetStringFormatTrimming
GdipDrawString
GdipSetStringFormatAlign

winhttp

WinHttpCrackUrl
WinHttpSetOption
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 744KB - Virtual size: 743KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 922KB - Virtual size: 921KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e40c0b551669732a9f2bfeba3891aad6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

webview2loader

ws2_32

comdlg32

winspool.drv

winmm

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

comctl32

uxtheme

gdi32

msimg32

gdiplus

winhttp

bcrypt

crypt32

Sections

.text Size: 3.4MB - Virtual size: 3.4MB

.rdata Size: 744KB - Virtual size: 743KB

.data Size: 52KB - Virtual size: 64KB

.rsrc Size: 922KB - Virtual size: 921KB

.reloc Size: 154KB - Virtual size: 153KB

.text
Size: 3.4MB - Virtual size: 3.4MB

.rdata
Size: 744KB - Virtual size: 743KB

.data
Size: 52KB - Virtual size: 64KB

.rsrc
Size: 922KB - Virtual size: 921KB

.reloc
Size: 154KB - Virtual size: 153KB