2024-09-01_6ae08a2c71e1b2529e36ed8a18f59303_avoslocker_cobalt-strike_hijackloader

Sharing

Copy URL Twitter E-mail

General

Target

2024-09-01_6ae08a2c71e1b2529e36ed8a18f59303_avoslocker_cobalt-strike_hijackloader
Size

722KB
MD5

6ae08a2c71e1b2529e36ed8a18f59303
SHA1

2a4a8d34b0db08db064a585e06ff2ddeefe84286
SHA256

f37cb533e9478eef66f3ae5380e2f3e1d00731e96b5cbe7e67262a180a8d65b9
SHA512

041f62ed48d7415287e9d3f21dec3b773979c1cae3d9173d48af2305a841bccb9451f0b1e831b093df23822fc60986f637dfc496860741d5107bbdd2d77f621c
SSDEEP

12288:nZc08o70L43SZiHk/dg+vVeNFEIj2K+T4DPl0Tk7WCExQKf:nZcEP3cMgdTVeNFygPJ7HEyKf

Score

1^/10

Malware Config

Signatures

Files

2024-09-01_6ae08a2c71e1b2529e36ed8a18f59303_avoslocker_cobalt-strike_hijackloader
.exe windows:6 windows x86 arch:x86

ff376f6b4fa772487aef59913a1aa537

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:7a:0e:dc:4e:6f:47:da:bd:74:9f:6e
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

09/10/2023, 07:40

Not After

09/10/2026, 07:40

Subject

CN=ZOHO Corporation Private Limited,O=ZOHO Corporation Private Limited,L=Chennai,ST=Tamil Nadu,C=IN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

28:81:90:37:fe:eb:fc:f7:13:c0:73:eb:33:e1:46:65:e3:57:c7:0d:f2:79:8d:0f:cc:6c:80:7b:22:60:33:8c
Signer

Actual PE Digest

28:81:90:37:fe:eb:fc:f7:13:c0:73:eb:33:e1:46:65:e3:57:c7:0d:f2:79:8d:0f:cc:6c:80:7b:22:60:33:8c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winhttp

WinHttpOpen
WinHttpReceiveResponse
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpQueryDataAvailable
WinHttpSetTimeouts
WinHttpQueryOption
WinHttpConnect

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
FindClose
FindFirstFileW
GetFullPathNameW
GetVolumeInformationW
LockFile
UnlockFile
DuplicateHandle
GetThreadLocale
FileTimeToSystemTime
VirtualProtect
SetErrorMode
FileTimeToLocalFileTime
GetFileAttributesExW
GetFileSizeEx
InitializeCriticalSection
SetFileAttributesW
SystemTimeToTzSpecificLocalTime
GetTickCount
GetUserDefaultLCID
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
CompareStringW
GlobalFindAtomW
GetSystemDirectoryW
EncodePointer
MulDiv
LoadLibraryA
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpW
lstrcmpA
GlobalDeleteAtom
FreeLibrary
GetCurrentThread
CreateEventW
SetEvent
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringA
GetACP
GlobalUnlock
GlobalLock
GlobalAlloc
OutputDebugStringW
FormatMessageW
FlushFileBuffers
GetFileSize
GetLocalTime
GlobalFree
GetCurrentThreadId
SetEndOfFile
GetEnvironmentVariableW
SetLastError
GetModuleHandleW
LoadLibraryExW
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlUnwind
GetCommandLineA
MoveFileExW
GetTimeZoneInformation
GetDriveTypeW
SetStdHandle
VerifyVersionInfoW
VerSetConditionMask
LocalFree
SetCurrentDirectoryW
GetVersionExW
LocalAlloc
GetCurrentProcess
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
CreateFileW
SetFilePointer
SetFileTime
WriteFile
ReadFile
CreateProcessW
CreateThread
Process32FirstW
Process32NextW
Sleep
CreateToolhelp32Snapshot
OpenProcess
GetFileAttributesW
TerminateProcess
IsBadStringPtrW
CopyFileW
GetCurrentProcessId
GetFileType
ExitProcess
GetModuleHandleExW
TlsAlloc
GetProcAddress
LoadLibraryW
DeleteFileW
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetStdHandle
WideCharToMultiByte
FindResourceW
LoadResource
CloseHandle
LockResource
MultiByteToWideChar
GetModuleFileNameW
GetCommandLineW
SizeofResource
CreateDirectoryW
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionAndSpinCount
HeapFree
HeapQueryInformation
GetSystemInfo
VirtualAlloc
VirtualQuery
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
SetFilePointerEx
LCMapStringW
IsValidLocale
EnumSystemLocalesW
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetFileTime
WriteConsoleW

user32

IsRectEmpty
IntersectRect
SetRect
InvalidateRgn
CopyAcceleratorTableW
CharNextW
CharUpperW
GetSysColorBrush
LoadCursorW
ReleaseCapture
SetCapture
InvalidateRect
RealChildWindowFromPoint
DestroyMenu
ClientToScreen
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
IsDialogMessageW
SetWindowTextW
MoveWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
UnhookWindowsHookEx
GetTopWindow
GetClassNameW
GetClassLongW
SetWindowLongW
PtInRect
EqualRect
GetSysColor
MapWindowPoints
GetNextDlgGroupItem
AdjustWindowRectEx
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
GetScrollPos
RedrawWindow
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
SetFocus
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
LoadBitmapW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
GetMenuItemCount
GetMenuItemID
MessageBeep
CopyRect
ReleaseDC
RegisterClipboardFormatW
PostThreadMessageW
ScreenToClient
GetDC
MapDialogRect
GetWindow
SetWindowContextHelpId
SetWindowPos
GetWindowRect
GetSubMenu
GetDesktopWindow
SetActiveWindow
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
IsWindow
GetLastActivePopup
GetWindowThreadProcessId
GetWindowLongW
IsWindowEnabled
SetCursor
PostQuitMessage
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
GetActiveWindow
IsWindowVisible
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetParent
OffsetRect
SetRectEmpty
SendDlgItemMessageA
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
GetSystemMenu
PostMessageW
MessageBoxW
SendMessageW
GetSystemMetrics
DrawIcon
ShowWindow
SetTimer
LoadIconW
GetClientRect
KillTimer
IsIconic
EnableWindow
UnregisterClassW
SetPropW

gdi32

ScaleViewportExtEx
ScaleWindowExtEx
GetBkColor
GetRgnBox
OffsetViewportOrgEx
SetWindowExtEx
SetViewportOrgEx
GetMapMode
SetViewportExtEx
ExtTextOutW
TextOutW
GetTextColor
SetMapMode
SelectObject
ExtSelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetStockObject
GetClipBox
Escape
DeleteObject
GetObjectW
SetTextColor
SetBkColor
CreateBitmap
GetDeviceCaps
CreateRectRgnIndirect
DeleteDC

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

SetSecurityDescriptorDacl
RegSetValueExW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
RegQueryValueExW
RegOpenKeyExW
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
InitializeSecurityDescriptor
GetUserNameW
RegCloseKey
RegCreateKeyExW

shell32

SHGetFolderPathW
ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathIsURLW
PathRemoveFileSpecW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW
PathStripToRootW
PathFileExistsW

ole32

CoCreateInstance
CoCreateGuid
CoUninitialize
CoInitializeEx
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CoTaskMemFree
CoTaskMemAlloc
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
CoFreeUnusedLibraries
OleInitialize
OleUninitialize
CoRevokeClassObject
OleFlushClipboard
OleIsCurrentClipboard
CoRegisterMessageFilter
CoInitialize

oleaut32

OleCreateFontIndirect
VariantCopy
SafeArrayDestroy
SysFreeString
SysAllocString
SysAllocStringLen
VariantInit
VariantClear
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantChangeType

oledlg

OleUIBusyW

oleacc

CreateStdAccessibleObject
LresultFromObject

Sections

.text
Size: 418KB - Virtual size: 418KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff376f6b4fa772487aef59913a1aa537

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

32:7a:0e:dc:4e:6f:47:da:bd:74:9f:6eCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

28:81:90:37:fe:eb:fc:f7:13:c0:73:eb:33:e1:46:65:e3:57:c7:0d:f2:79:8d:0f:cc:6c:80:7b:22:60:33:8cSigner

Headers

DLL Characteristics

File Characteristics

Imports

winhttp

version

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

oleacc

Sections

.text Size: 418KB - Virtual size: 418KB

.rdata Size: 164KB - Virtual size: 163KB

.data Size: 10KB - Virtual size: 22KB

.rsrc Size: 84KB - Virtual size: 84KB

.reloc Size: 31KB - Virtual size: 30KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

32:7a:0e:dc:4e:6f:47:da:bd:74:9f:6e
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

28:81:90:37:fe:eb:fc:f7:13:c0:73:eb:33:e1:46:65:e3:57:c7:0d:f2:79:8d:0f:cc:6c:80:7b:22:60:33:8c
Signer

.text
Size: 418KB - Virtual size: 418KB

.rdata
Size: 164KB - Virtual size: 163KB

.data
Size: 10KB - Virtual size: 22KB

.rsrc
Size: 84KB - Virtual size: 84KB

.reloc
Size: 31KB - Virtual size: 30KB