Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-03_dd8ca0dd7f6d5a960d6fe7b796990ea0_avoslocker_hijackloader_revil.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-10-03_dd8ca0dd7f6d5a960d6fe7b796990ea0_avoslocker_hijackloader_revil.exe
Resource
win10v2004-20240802-en
Target
2024-10-03_dd8ca0dd7f6d5a960d6fe7b796990ea0_avoslocker_hijackloader_revil
Size
4.2MB
MD5
dd8ca0dd7f6d5a960d6fe7b796990ea0
SHA1
671c163eed738cd5f882c78c68356ef49ddba5d6
SHA256
273f9100773e5756a90adebca24cf6ec4169d8f061a0913811f71db51def7e77
SHA512
44564dd485ff40b2aaf8eb07443244283422a3a046a8c9635481fac9de3c8adc421f2e15d59e14848c6681301f545008d60aaeaf06bd412de0a2093b416571b7
SSDEEP
98304:X6voCB4MRoDYg4Ysxh59AF+IBpgXyhWVZAXYAXkxDQXf/Ud0IYNO66/aGrIFSd20:2oCB4MRoDYg4Ysxh59AF+IBpgXyCZAX8
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
d:\Webhost\25-09-2024\WindowsBuilds\MYCOMPUTER_ACTIVEX\9157272\mycomp\mycomp\DesktopCentral\ZohoMeetingApp\ZAAudio\ZAAudioClient\bin\Win32\Release\ZAAudioClient.pdb
getpeername
bind
accept
ntohs
WSACleanup
WSAStartup
WSARecv
WSARecvFrom
WSASend
WSASendTo
ntohl
getaddrinfo
getsockopt
listen
recv
recvfrom
freeaddrinfo
ioctlsocket
htons
connect
socket
inet_addr
closesocket
WSAIoctl
send
sendto
WSASetLastError
getsockname
setsockopt
shutdown
WSAGetLastError
CertFreeCertificateChain
CertCloseStore
CertEnumCertificatesInStore
CertVerifyCertificateChainPolicy
CertOpenSystemStoreW
CertGetNameStringA
CertGetCertificateChain
CertCreateCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
CreateMutexW
LocalAlloc
ProcessIdToSessionId
FormatMessageW
GlobalAlloc
GlobalFree
CloseHandle
LocalFree
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
CreateEventW
SetEvent
CreateEventExW
SetThreadPriority
WaitForSingleObject
GetCurrentThread
CreateThread
ResetEvent
Sleep
SetLastError
GetCommandLineW
GetCurrentProcess
InitializeCriticalSection
MoveFileW
InterlockedDecrement
GetExitCodeThread
GetCurrentProcessId
CancelSynchronousIo
OpenEventW
ReadFile
WriteFile
FlushFileBuffers
CreateFileW
GetModuleFileNameW
CreateDirectoryW
WideCharToMultiByte
DeleteCriticalSection
MultiByteToWideChar
GetCurrentThreadId
GetProcessHeap
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
HeapReAlloc
LockResource
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
SizeofResource
ReadConsoleA
SetConsoleMode
LoadLibraryA
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SwitchToFiber
SystemTimeToFileTime
GetSystemTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetConsoleCtrlHandler
SetStdHandle
ReadConsoleW
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
ExitThread
GetCommandLineA
ExitProcess
WriteConsoleW
GetFileType
GetConsoleMode
GetConsoleCP
SetFilePointerEx
RtlUnwind
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
FormatMessageA
WaitForSingleObjectEx
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetStringTypeW
QueryPerformanceFrequency
EncodePointer
QueueUserWorkItem
GetModuleHandleExW
DuplicateHandle
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
CreateTimerQueue
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
SetFilePointer
GetTimeZoneInformation
GetEnvironmentVariableW
SetEnvironmentVariableW
GetComputerNameW
GetCurrentDirectoryW
GetLongPathNameW
GetSystemDirectoryW
GetStdHandle
DeleteFileW
GetFileAttributesW
GetFileAttributesExW
RemoveDirectoryW
SetEndOfFile
MoveFileExW
FindClose
FindFirstFileW
FindNextFileW
ReleaseMutex
GetHandleInformation
CreateIoCompletionPort
GetQueuedCompletionStatusEx
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitOnceExecuteOnce
GetTickCount64
SetFileCompletionNotificationModes
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
CryptGenRandom
CryptDestroyHash
CryptCreateHash
GetTokenInformation
ConvertSidToStringSidW
InitializeSecurityDescriptor
FreeSid
OpenProcessToken
CreateWellKnownSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
DeregisterEventSource
RegisterEventSourceW
CryptEnumProvidersW
ReportEventW
CryptSignHashW
CommandLineToArgvW
SHGetFolderPathW
PropVariantClear
CoTaskMemFree
CoInitializeEx
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
PathFileExistsW
PathIsDirectoryW
PathRemoveFileSpecW
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsW
BCryptGenRandom
??0ClientConnection@Connection@@QAE@$$QAV01@@Z
??0ClientConnection@Connection@@QAE@ABV01@@Z
??0ClientConnection@Connection@@QAE@XZ
??0HttpClient@0HttpHandler@@QAE@$$QAV001@@Z
??0HttpClient@0HttpHandler@@QAE@ABV001@@Z
??0HttpClient@0HttpHandler@@QAE@XZ
??0dcSocket@ClientSocket@SocketUtils@@QAE@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N1@Z
??0dcSocket@ClientSocket@SocketUtils@@QAE@XZ
??0dcWebSocket@ClientSocket@SocketUtils@@QAE@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_N001@Z
??0dcWebSocket@ClientSocket@SocketUtils@@QAE@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_N0@Z
??0dcWebSocket@ClientSocket@SocketUtils@@QAE@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_N0H000@Z
??0dcWebSocket@ClientSocket@SocketUtils@@QAE@XZ
??0socketWrapper@ClientSocket@SocketUtils@@QAE@ABV012@@Z
??0socketWrapper@ClientSocket@SocketUtils@@QAE@XZ
??1ClientConnection@Connection@@QAE@XZ
??1HttpClient@0HttpHandler@@QAE@XZ
??1dcSocket@ClientSocket@SocketUtils@@UAE@XZ
??1dcWebSocket@ClientSocket@SocketUtils@@UAE@XZ
??1socketWrapper@ClientSocket@SocketUtils@@UAE@XZ
??4ClientConnection@Connection@@QAEAAV01@$$QAV01@@Z
??4ClientConnection@Connection@@QAEAAV01@ABV01@@Z
??4HttpClient@0HttpHandler@@QAEAAV001@$$QAV001@@Z
??4HttpClient@0HttpHandler@@QAEAAV001@ABV001@@Z
??4socketWrapper@ClientSocket@SocketUtils@@QAEAAV012@ABV012@@Z
??_7ClientConnection@Connection@@6B@
??_7HttpClient@0HttpHandler@@6B@
??_7dcSocket@ClientSocket@SocketUtils@@6BClientConnection@Connection@@@
??_7dcSocket@ClientSocket@SocketUtils@@6BIReferenceCounter@@@
??_7dcWebSocket@ClientSocket@SocketUtils@@6B@
??_7dcWebSocket@ClientSocket@SocketUtils@@6BClientConnection@Connection@@@
??_7dcWebSocket@ClientSocket@SocketUtils@@6BIReferenceCounter@@@
??_7socketWrapper@ClientSocket@SocketUtils@@6BClientConnection@Connection@@@
??_7socketWrapper@ClientSocket@SocketUtils@@6BIReferenceCounter@@@
?DestroySocket@dcSocket@ClientSocket@SocketUtils@@UAEXXZ
?InitSDPOffer@dcWebSocket@ClientSocket@SocketUtils@@UAE_NXZ
?checkSenderThreadStatus@dcSocket@ClientSocket@SocketUtils@@MAE_NXZ
?cleanup@dcWebSocket@ClientSocket@SocketUtils@@UAEXXZ
?close@dcWebSocket@ClientSocket@SocketUtils@@UAEXXZ
?connect@dcWebSocket@ClientSocket@SocketUtils@@UAE_NXZ
?connectViaProxy@dcWebSocket@ClientSocket@SocketUtils@@UAE_NXZ
?getConnectedInterfaceID@socketWrapper@ClientSocket@SocketUtils@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getIsCertValidationNeeded@socketWrapper@ClientSocket@SocketUtils@@UAE_NXZ
?getIsSystemMode@socketWrapper@ClientSocket@SocketUtils@@UAE_NXZ
?getLastError@socketWrapper@ClientSocket@SocketUtils@@UAEHXZ
?getLastErrorMsg@socketWrapper@ClientSocket@SocketUtils@@UAEAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getProxyHostName@socketWrapper@ClientSocket@SocketUtils@@UAEAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getProxyPassword@socketWrapper@ClientSocket@SocketUtils@@UAEAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getProxyPort@socketWrapper@ClientSocket@SocketUtils@@UAEHXZ
?getProxyUserName@socketWrapper@ClientSocket@SocketUtils@@UAEAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getServerHostName@socketWrapper@ClientSocket@SocketUtils@@UAEAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getServerPort@socketWrapper@ClientSocket@SocketUtils@@UAEHXZ
?initSocketConfigurations@dcWebSocket@ClientSocket@SocketUtils@@AAE_NXZ
?initialize@dcWebSocket@ClientSocket@SocketUtils@@UAEXXZ
?isProxyEnabled@socketWrapper@ClientSocket@SocketUtils@@UAE_NXZ
?isSecureMode@socketWrapper@ClientSocket@SocketUtils@@UAE_NXZ
?isSocketLive@dcWebSocket@ClientSocket@SocketUtils@@UAE_NXZ
?receiveBytes@dcWebSocket@ClientSocket@SocketUtils@@UAEHPAEH@Z
?receiveString@dcWebSocket@ClientSocket@SocketUtils@@UAEHPADH@Z
?sendBytes@dcWebSocket@ClientSocket@SocketUtils@@UAEHPAEH@Z
?sendBytesAsync@dcSocket@ClientSocket@SocketUtils@@UAE_NPAEH@Z
?sendFrameAsync@dcSocket@ClientSocket@SocketUtils@@UAEXAAV?$SmartPtr@VDataFrame@@@@@Z
?sendString@dcWebSocket@ClientSocket@SocketUtils@@UAEHPAD@Z
?sendString@dcWebSocket@ClientSocket@SocketUtils@@UAEHPADH@Z
?sendStringAsync@dcSocket@ClientSocket@SocketUtils@@UAE_NPAD@Z
?sendStringAsync@dcSocket@ClientSocket@SocketUtils@@UAE_NPADH@Z
?sendVectorAsync@dcSocket@ClientSocket@SocketUtils@@UAEXAAV?$vector@DV?$allocator@D@std@@@std@@@Z
?setCandidate@dcWebSocket@ClientSocket@SocketUtils@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setCandidateReceiver@dcWebSocket@ClientSocket@SocketUtils@@UAE_NP6A_NPAD@Z@Z
?setConnectionDetails@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_N0H00_J@Z
?setConnectionDetails@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_N@Z
?setConnectionMode@socketWrapper@ClientSocket@SocketUtils@@UAEX_N@Z
?setDataChannelStateReceiver@dcWebSocket@ClientSocket@SocketUtils@@UAE_NP6A_NPAD@Z@Z
?setErrorReceiver@dcWebSocket@ClientSocket@SocketUtils@@UAE_NP6A_NHPBD@Z@Z
?setIsCertValidationNeeded@socketWrapper@ClientSocket@SocketUtils@@UAEX_N@Z
?setIsSystemMode@socketWrapper@ClientSocket@SocketUtils@@UAEX_N@Z
?setLastError@dcSocket@ClientSocket@SocketUtils@@MAEXH@Z
?setLastError@dcSocket@ClientSocket@SocketUtils@@MAEXHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setLastError@socketWrapper@ClientSocket@SocketUtils@@MAEXH@Z
?setLastError@socketWrapper@ClientSocket@SocketUtils@@MAEXHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setLastWinErrorCode@socketWrapper@ClientSocket@SocketUtils@@MAEXH@Z
?setLoggerConfigurations@dcSocket@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?setPocoObjectReferences@dcWebSocket@ClientSocket@SocketUtils@@AAEXXZ
?setProxyDetails@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H00@Z
?setProxyHostName@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setProxyPassword@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setProxyPort@socketWrapper@ClientSocket@SocketUtils@@UAEXH@Z
?setProxySwitch@socketWrapper@ClientSocket@SocketUtils@@UAEX_N@Z
?setProxyUserName@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setSDPHandShakeMessage@dcWebSocket@ClientSocket@SocketUtils@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setSDPReceiver@dcWebSocket@ClientSocket@SocketUtils@@UAE_NP6A_NPAD@Z@Z
?setServerEndpoint@dcSocket@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setServerHostName@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setServerPort@socketWrapper@ClientSocket@SocketUtils@@UAEXH@Z
?setTurnInfo@dcWebSocket@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00@Z
?shutDownSocket@dcWebSocket@ClientSocket@SocketUtils@@UAEXXZ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ