2024-08-22_f0e67bb85fe9bcb614523c55a2bf6943_avoslocker_chir_hijackloader_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-08-22_f0e67bb85fe9bcb614523c55a2bf6943_avoslocker_chir_hijackloader_revil
Size

3.0MB
MD5

f0e67bb85fe9bcb614523c55a2bf6943
SHA1

949b719a3cbe9f6ed9db9984ca79e181b340a4b2
SHA256

0bd5532e8a04f0d1f2b916a46c43e28bfd89d9bf5a2c6df9803a727925b1c18e
SHA512

655693d255915cfd71cd2044d0a1a2327c8d0efb23255e1931bfca9d22028350818b299b47c5339370635ce690e2721f9127efc3419029c780c73df4cc0ed9cb
SSDEEP

49152:lSHCxniaO7mNf/P2Y8zHbFU24HbZtPbqgRt32pe9VumKmoxIREMT:l1xniaWmNHP29zHxU24HbPqgf2p6Km

Score

1^/10

Malware Config

Signatures

Files

2024-08-22_f0e67bb85fe9bcb614523c55a2bf6943_avoslocker_chir_hijackloader_revil
.exe windows:6 windows x86 arch:x86

afcb4ae5412c1bc0fed0cf2ae69a4f5d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:88:61:06:2e:3b:97:5a:b7:6d:a2:89:80:c5:b9:5e
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/03/2023, 00:00

Not After

20/03/2025, 23:59

Subject

CN=Chongqing Zhongcheng Network Technology Co. Ltd.,O=Chongqing Zhongcheng Network Technology Co. Ltd.,ST=重庆市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:01:f1:4a:61:d5:37:4f:15:82:01:c6:26:3d:63:e2:f5:c8:0e:e2:5b:1a:39:fc:5e:fc:fa:c2:94:af:b8:f3
Signer

Actual PE Digest

bd:01:f1:4a:61:d5:37:4f:15:82:01:c6:26:3d:63:e2:f5:c8:0e:e2:5b:1a:39:fc:5e:fc:fa:c2:94:af:b8:f3

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

DeregisterEventSource
RegisterEventSourceA
ReportEventA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

user32

InflateRect
SetCursor
GetSysColor
ClientToScreen
HideCaret
ShowCaret
CharNextW
GetWindowRgn
MessageBoxW
SetWindowRgn
PostMessageW
PostQuitMessage
KillTimer
LoadIconW
SetTimer
SendMessageW
GetPropW
SetPropW
TrackMouseEvent
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
GetDesktopWindow
CallWindowProcW
RegisterClassExW
IsZoomed
OffsetRect
MoveWindow
GetKeyState
DestroyWindow
ReleaseDC
GetDC
GetClientRect
SetWindowPos
GetWindowLongW
SetWindowLongW
GetCaretBlinkTime
SetCaretPos
CreateCaret
GetFocus
IntersectRect
GetWindow
SetFocus
GetUpdateRect
BeginPaint
EndPaint
IsRectEmpty
IsIconic
UnionRect
GetWindowRect
UpdateLayeredWindow
InvalidateRect
CreateWindowExW
ScreenToClient
GetCursorPos
GetMessageW
TranslateMessage
DispatchMessageW
IsWindow
SetCapture
ReleaseCapture
PtInRect
GetParent
DefWindowProcW
ShowWindow
EnableWindow
GetMonitorInfoW
MonitorFromWindow
GetCaretPos
FillRect
DrawTextW
SetRect
CharPrevW
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
MapWindowPoints
InvalidateRgn
CreateAcceleratorTableW
FindWindowW
RegisterClassW
LoadCursorW
GetClassInfoExW

gdi32

GetObjectW
CreateFontIndirectW
CreatePen
DeleteObject
DeleteDC
CreateCompatibleDC
CreateDIBSection
SelectObject
SaveDC
RestoreDC
CreateCompatibleBitmap
BitBlt
GetStockObject
TextOutW
GetTextExtentPoint32W
GetCharABCWidthsW
SetBkColor
SetTextColor
SetBkMode
GetObjectA
RoundRect
Rectangle
GetTextMetricsW
LineTo
MoveToEx
CreatePenIndirect
CreateSolidBrush
SetStretchBltMode
StretchBlt
CombineRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
SelectClipRgn
GetDeviceCaps
PtInRegion
CreateRectRgn
CreateRoundRectRgn

ws2_32

WSACleanup
WSAGetLastError
__WSAFDIsSet
freeaddrinfo
recvfrom
sendto
select
WSASetLastError
recv
send
bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSAIoctl
accept
listen
ioctlsocket
htonl
ntohl
gethostname
shutdown
WSAStartup
getaddrinfo

wldap32

ord32
ord79
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord143
ord30
ord200
ord35
ord27
ord301
ord33

normaliz

IdnToAscii

shlwapi

PathFileExistsW

kernel32

GetStartupInfoW
InitializeSListHead
OutputDebugStringW
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CompareStringW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
SetFilePointerEx
SetConsoleCtrlHandler
SetEvent
UnhandledExceptionFilter
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetFileSizeEx
GetSystemTimeAsFileTime
LCMapStringW
LCMapStringEx
EncodePointer
GetStringTypeW
SetUnhandledExceptionFilter
GetCPInfo
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ResetEvent
IsProcessorFeaturePresent
GetConsoleCP
IsDebuggerPresent
LocalFree
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetLocaleInfoW
SetStdHandle
HeapReAlloc
GetFullPathNameW
WTSGetActiveConsoleSessionId
K32GetModuleBaseNameA
CreateFileA
OutputDebugStringA
HeapAlloc
FlushConsoleInputBuffer
GlobalMemoryStatus
SetEndOfFile
GetTimeZoneInformation
SetConsoleMode
ReadConsoleInputW
FlushFileBuffers
FindFirstFileExW
HeapFree
GetCurrentProcessId
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
WriteConsoleW
CreateDirectoryW
SizeofResource
FindNextFileW
GetCurrentProcess
WriteFile
TerminateProcess
GetModuleFileNameW
FindClose
WaitForSingleObject
CreateFileW
GetFileAttributesW
MultiByteToWideChar
GetLastError
LockResource
DeleteFileA
CloseHandle
LoadLibraryW
LoadResource
FindResourceW
GetProcAddress
GetModuleHandleW
WideCharToMultiByte
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
GetCommandLineW
CreateMutexW
CreateEventW
GetCurrentDirectoryW
GetTickCount
GetACP
FreeResource
ExitProcess
ReadFile
SetFilePointer
DuplicateHandle
SystemTimeToFileTime
GetFileType
DosDateTimeToFileTime
MulDiv
GetFileSize
InitializeCriticalSectionAndSpinCount
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocalTime
GetTickCount64
SetLastError
EnterCriticalSection
LeaveCriticalSection
VerSetConditionMask
FreeLibrary
LoadLibraryA
VerifyVersionInfoA
Sleep
SleepEx
FormatMessageA
WaitForSingleObjectEx
GetStdHandle
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
GetCurrentThreadId
GetModuleHandleA
GetSystemTime
QueryPerformanceCounter

shell32

SHGetSpecialFolderPathW
ShellExecuteW
ord155
SHGetPathFromIDListW
SHGetFolderLocation
CommandLineToArgvW

ole32

CoInitializeSecurity
CoSetProxyBlanket
CreateStreamOnHGlobal
CoCreateInstance
OleLockRunning
CLSIDFromString
CoUninitialize
CoInitialize
CLSIDFromProgID

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString

gdiplus

GdipLoadImageFromStream
GdipImageSelectActiveFrame
GdipDrawImageRectI
GdipCloneImage
GdipDisposeImage
GdipGetImageHeight
GdipGetImageWidth
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDrawString
GdipMeasureString
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdiplusStartup
GdipCloneStringFormat
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipSetTextRenderingHint
GdipFillRectangleI
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateSolidFill
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdipStringFormatGetGenericTypographic

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

comctl32

ord17
_TrackMouseEvent

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

iphlpapi

GetAdaptersInfo

wtsapi32

WTSQueryUserToken

wininet

InternetGetConnectedState

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 399KB - Virtual size: 399KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 894KB - Virtual size: 893KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

afcb4ae5412c1bc0fed0cf2ae69a4f5d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0f:88:61:06:2e:3b:97:5a:b7:6d:a2:89:80:c5:b9:5eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

bd:01:f1:4a:61:d5:37:4f:15:82:01:c6:26:3d:63:e2:f5:c8:0e:e2:5b:1a:39:fc:5e:fc:fa:c2:94:af:b8:f3Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

user32

gdi32

ws2_32

wldap32

normaliz

shlwapi

kernel32

shell32

ole32

oleaut32

gdiplus

imm32

comctl32

version

iphlpapi

wtsapi32

wininet

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 399KB - Virtual size: 399KB

.data Size: 43KB - Virtual size: 59KB

.rsrc Size: 894KB - Virtual size: 893KB

.reloc Size: 130KB - Virtual size: 130KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0f:88:61:06:2e:3b:97:5a:b7:6d:a2:89:80:c5:b9:5e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

bd:01:f1:4a:61:d5:37:4f:15:82:01:c6:26:3d:63:e2:f5:c8:0e:e2:5b:1a:39:fc:5e:fc:fa:c2:94:af:b8:f3
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 399KB - Virtual size: 399KB

.data
Size: 43KB - Virtual size: 59KB

.rsrc
Size: 894KB - Virtual size: 893KB

.reloc
Size: 130KB - Virtual size: 130KB