2024-09-30_05627bfa392ee3c8d75a6a79aac0f189_avoslocker_cobalt-strike

Sharing

Copy URL

Twitter E-mail

General

Target

2024-09-30_05627bfa392ee3c8d75a6a79aac0f189_avoslocker_cobalt-strike
Size

899KB
MD5

05627bfa392ee3c8d75a6a79aac0f189
SHA1

ff9c27344cdd561e56a65ac3b10ef8292842c268
SHA256

1859a9127247c9c32e852c5709142e3f04cb933fe3121807fe9399e630927429
SHA512

fdd0c04a4fc052a833062c03584dd88f7186a45807f162662b7fe2d8220d4563e964d1496b9d872431a7f141bf488c5655148afcfef8629f7b141ede9853f16f
SSDEEP

12288:AkmyvKCkBJuBEbI3+7mjx3rzlM1k1wMi5IZ77So6PkYWuUamsq8x8gI0glTdj:vkBI3s2flM1kOMsIucYzx8gI02

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-09-30_05627bfa392ee3c8d75a6a79aac0f189_avoslocker_cobalt-strike

Files

2024-09-30_05627bfa392ee3c8d75a6a79aac0f189_avoslocker_cobalt-strike
.exe windows:6 windows x86 arch:x86

78293443550bdf17e0d97bc1aff81262

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\jenkins\workspace\Client\Client\DMT\windows\release\crashrpt\build\windows\Bin\MT_Release\zCrashReportExe.pdb

Imports

kernel32

DeleteCriticalSection
MapViewOfFile
CreateDirectoryW
SizeofResource
SetLastError
GetCurrentProcess
GetModuleFileNameW
GetFileAttributesW
OpenProcess
GetPrivateProfileStringW
Sleep
FormatMessageW
LockResource
GlobalFree
LoadLibraryW
FindResourceExW
LoadResource
FindResourceW
SystemTimeToFileTime
GetModuleHandleW
FreeLibrary
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
VirtualQueryEx
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
FindFirstFileW
GetFileSizeEx
GetFullPathNameW
FindNextFileW
FindClose
HeapDestroy
K32GetProcessMemoryInfo
FileTimeToSystemTime
GetLocalTime
ReadProcessMemory
GetSystemTime
GetProcessTimes
GetCommandLineW
GetCurrentThreadId
lstrcmpiW
LoadLibraryExW
ReadFile
WriteFile
GetSystemInfo
CreateMutexW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CreateThread
GetCurrentProcessId
GlobalMemoryStatusEx
CreateProcessW
IsDebuggerPresent
IsProcessorFeaturePresent
WriteConsoleW
SetEndOfFile
FlushFileBuffers
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
ReadConsoleW
GetConsoleMode
K32GetProcessImageFileNameW
DecodePointer
SetUnhandledExceptionFilter
RaiseException
HeapReAlloc
GetLastError
HeapSize
UnmapViewOfFile
OpenFileMappingW
InitializeCriticalSectionEx
VerifyVersionInfoW
VerSetConditionMask
GetProcAddress
CloseHandle
CreateFileW
WritePrivateProfileStringW
GetProcessHeap
HeapAlloc
MultiByteToWideChar
SetFilePointerEx
GetTimeZoneInformation
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
HeapFree
GetStartupInfoW
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
RtlUnwind
LocalFree
QueryPerformanceCounter
TerminateProcess
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime

user32

EnumDisplayDevicesW
GetGuiResources
CharNextW
DestroyWindow
DefWindowProcW
IsWindow
PostMessageW
SetProcessDefaultLayout
SendMessageW

advapi32

RegOpenKeyExW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
RegDeleteValueW
RegCloseKey
RegQueryValueExW

shell32

CommandLineToArgvW

ole32

CoInitialize
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoSetProxyBlanket
CoUninitialize
CoCreateInstance

oleaut32

VariantClear
SysFreeString
SysAllocString
VariantInit
VarUI4FromStr

wintrust

WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

shlwapi

PathStripPathW

comctl32

InitCommonControlsEx

Sections

.text
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 576KB - Virtual size: 580KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

78293443550bdf17e0d97bc1aff81262

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

wintrust

crypt32

shlwapi

comctl32

Sections

.text Size: 186KB - Virtual size: 185KB

.rdata Size: 50KB - Virtual size: 49KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 83KB - Virtual size: 82KB

.reloc Size: 576KB - Virtual size: 580KB

.text
Size: 186KB - Virtual size: 185KB

.rdata
Size: 50KB - Virtual size: 49KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 83KB - Virtual size: 82KB

.reloc
Size: 576KB - Virtual size: 580KB