2024-10-04_6ccb9f32488bb54dc760f3e6ddc81225_avoslocker_hijackloader_revil

Sharing

Copy URL Twitter E-mail

General

Target

2024-10-04_6ccb9f32488bb54dc760f3e6ddc81225_avoslocker_hijackloader_revil
Size

3.1MB
MD5

6ccb9f32488bb54dc760f3e6ddc81225
SHA1

398992d920dca10c8aa6e5a33253b57e736f5265
SHA256

dba369ca24a82878c1f37756d648ffe001a73cc5323d971497023f191868e4ac
SHA512

56a1fe9adc919e6476a4447dd383b4b06586837821dae75994fe0f6d8725cd1b064df6946469c3d663f64976b02c828824a53cf6d170392fef050c1bd89c37c3
SSDEEP

49152:BvlV8WhqbzrBjYYtvVE4hOxvPu+7NrxTfxLiffwv6Yw3lIK+hf2M:BvlKI8BjvVEiO8+7NrDLiff+/

Score

1^/10

Malware Config

Signatures

Files

2024-10-04_6ccb9f32488bb54dc760f3e6ddc81225_avoslocker_hijackloader_revil
.exe windows:6 windows x86 arch:x86

f2d0553a338a86ebc3e7ab9cb8dfa4e7

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:ba:be:96:e5:0e:a2:5f:3f:0e:88:42:9a:74:a4:62
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

17/06/2024, 00:00

Not After

19/06/2027, 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:c3:19:43:a2:bd:14:66:3d:e4:76:f5:c7:47:0d:20:fd:9f:3d:c7:6b:2b:1f:c0:cc:0e:41:d6:c8:1f:7b:d4
Signer

Actual PE Digest

1b:c3:19:43:a2:bd:14:66:3d:e4:76:f5:c7:47:0d:20:fd:9f:3d:c7:6b:2b:1f:c0:cc:0e:41:d6:c8:1f:7b:d4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\PCGMR_BUILD\Cim\CiSrc\pdfconverter\pdfconverter_sdk_sogou\product\win32\pdfsdk.pdb

Imports

kernel32

UnmapViewOfFile
GetFileInformationByHandle
GetExitCodeThread
OutputDebugStringW
TerminateThread
WritePrivateProfileStringW
FreeResource
LocalFree
VerSetConditionMask
VerifyVersionInfoW
GetDiskFreeSpaceExW
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
GetComputerNameA
GetTickCount64
lstrcmpiW
LoadLibraryExW
GetProcessHeap
DeleteCriticalSection
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
LoadLibraryW
RaiseException
CloseHandle
GetCurrentDirectoryW
LocalFileTimeToFileTime
WriteConsoleW
ReadConsoleInputW
SetConsoleMode
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
ReadConsoleW
GetConsoleMode
HeapReAlloc
GetUserDefaultLCID
SetFileTime
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetConsoleCP
SetConsoleCtrlHandler
SetFilePointerEx
GetFileAttributesExW
CreateFileW
ExitThread
GetModuleHandleExW
ExitProcess
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
GetCommandLineA
GetFullPathNameW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GlobalMemoryStatus
FlushConsoleInputBuffer
GetSystemTime
VerifyVersionInfoA
PeekNamedPipe
GetFileType
GetStdHandle
GetEnvironmentVariableA
CompareFileTime
MoveFileExA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
SleepEx
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
GetPrivateProfileIntW
GetCurrentProcessId
FormatMessageW
Sleep
GetCurrentThreadId
CreateMutexW
SetEndOfFile
SetLastError
GetFileSizeEx
ResetEvent
CreateThread
SetEvent
CreateEventW
WaitForMultipleObjects
GetTempPathW
GetLocalTime
MoveFileW
CopyFileW
lstrlenW
GetCommandLineW
GetTickCount
GetWindowsDirectoryW
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
WriteFile
SystemTimeToFileTime
MoveFileExW
RemoveDirectoryW
FindNextFileW
DeleteFileW
GetPrivateProfileStringW
GetFileAttributesW
FindClose
InitializeCriticalSection
GetModuleFileNameW
FindFirstFileW
CreateDirectoryW
IsValidLocale
LockResource
GetLastError
GetLogicalDriveStringsW
HeapSize
OpenProcess
WaitForSingleObject
InitializeCriticalSectionEx
TerminateProcess
GetCurrentProcess
HeapFree
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
GetCPInfo
EncodePointer
GetStringTypeW
GetFileSize
SetFilePointer
ReadFile
GetSystemDirectoryW
GetVersionExW
FileTimeToSystemTime
GetExitCodeProcess
FreeLibrary
GetModuleHandleW
FreeLibraryAndExitThread
CreateProcessW
QueryDosDeviceW
EnumSystemLocalesW
SizeofResource

user32

UnregisterClassW
ReleaseDC
SystemParametersInfoW
GetDC
CopyRect
GetMonitorInfoW
OffsetRect
RegisterWindowMessageW
DestroyMenu
CreatePopupMenu
wsprintfW
GetWindowTextW
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
InvalidateRect
GetDlgItem
SetWindowLongW
IsWindow
SetWindowTextW
SendMessageW
DestroyWindow
CallWindowProcW
DefWindowProcW
GetWindowTextLengthW
GetWindowLongW
EndPaint
BeginPaint
GetClassInfoExW
DrawTextW
GetClientRect
LoadCursorW
SetFocus
MoveWindow
ShowWindow
RegisterClassExW
CreateWindowExW
FillRect
IsWindowVisible
InflateRect
PostMessageW
GetDesktopWindow
EnableWindow
GetNextDlgTabItem
GetCursorPos
SetForegroundWindow
ReleaseCapture
PtInRect
GetParent
SetRect
UpdateLayeredWindow
SetRectEmpty
SetCursor
SetCapture
FindWindowW
TranslateMessage
IsWindowEnabled
GetForegroundWindow
AttachThreadInput
MapWindowPoints
IsChild
PeekMessageW
GetDlgCtrlID
IsDialogMessageW
DispatchMessageW
GetActiveWindow
ScreenToClient
SetActiveWindow
MonitorFromWindow
SetWindowPos
AppendMenuW
TrackPopupMenu
MonitorFromPoint
GetMenuItemCount
SetTimer
LoadBitmapW
GetMenuStringW
LoadImageW
GetWindowThreadProcessId
GetMessageW
EqualRect
DestroyIcon
ClientToScreen
ChangeWindowMessageFilter
IsRectEmpty
IntersectRect
LoadIconW
PostThreadMessageW
GetWindow
GetWindowRect
CharNextW
GetFocus
KillTimer
DrawIconEx
GetMenuItemInfoW

gdi32

GetClipRgn
OffsetRgn
TextOutW
LineTo
MoveToEx
ExtSelectClipRgn
RoundRect
GetViewportOrgEx
SaveDC
StretchBlt
CreatePen
SetStretchBltMode
RestoreDC
CreateBitmap
CreateDIBSection
GetStockObject
CreateRectRgnIndirect
CreateRoundRectRgn
CreateRectRgn
Rectangle
SelectClipRgn
GetObjectW
GetTextColor
RectInRegion
CreateFontIndirectW
GetCurrentObject
CombineRgn
ExtTextOutW
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetTextExtentPoint32W
SetBkMode
SetViewportOrgEx
DeleteDC
SetTextColor
SetBkColor
DeleteObject
CreateSolidBrush
GetDeviceCaps

advapi32

CryptEnumProvidersA
CryptDestroyHash
CryptCreateHash
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegOpenKeyW
RegQueryValueExW
CryptDecrypt
DeregisterEventSource
RegisterEventSourceA
ReportEventA
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptSignHashA

shell32

Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteW
ShellExecuteExW
SHBindToParent
SHParseDisplayName
SHGetDesktopFolder
SHGetSpecialFolderPathW
SHCreateDirectoryExW
ord155
ord680

ole32

CreateStreamOnHGlobal
CoCreateGuid
CoCreateInstance
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc

oleaut32

VarUI4FromStr

shlwapi

StrToIntA
PathAddBackslashW
StrToInt64ExW
StrToIntW
PathFileExistsW
PathRemoveFileSpecW
PathCombineW
PathFindFileNameW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

comctl32

DrawShadowText
_TrackMouseEvent

msimg32

AlphaBlend

gdiplus

GdipGetFontCollectionFamilyCount
GdipFillRectangleI
GdipFree
GdipDeleteFontFamily
GdipSetStringFormatFlags
GdipPrivateAddFontFile
GdipDeletePrivateFontCollection
GdipSetStringFormatAlign
GdipCloneFontFamily
GdipNewPrivateFontCollection
GdipCreatePen1
GdipDeletePen
GdipDeleteFont
GdipMeasureString
GdipCloneBrush
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipGetFontCollectionFamilyList
GdipCreateLineBrushFromRectWithAngleI
GdipDeleteStringFormat
GdipDrawString
GdipSetCompositingQuality
GdipGetFamily
GdipAddPathPieI
GdipDrawRectangleI
GdipAddPathRectangleI
GdipAddPathArcI
GdipSetPenStartCap
GdipDeletePath
GdipSetSmoothingMode
GdipSetClipPath
GdipCreatePath
GdipFillPath
GdipAddPathStringI
GdipSetPenDashStyle
GdipDrawLine
GdipSetPixelOffsetMode
GdipFillRectangle
GdipClosePathFigure
GdipDrawPath
GdipResetWorldTransform
GdipSetPenEndCap
GdipRotateWorldTransform
GdipGetFontSize
GdipTranslateWorldTransform
GdipSetPenMode
GdipDrawImageI
GdipDeleteGraphics
GdipLoadImageFromFile
GdipGetImageHeight
GdipSetImageAttributesColorMatrix
GdipImageRotateFlip
GdipDrawImagePointsRectI
GdipDrawImageRectRect
GdipCloneImage
GdipCreateBitmapFromStream
GdipDrawImageRectI
GdipDisposeImageAttributes
GdipDisposeImage
GdipSetInterpolationMode
GdipCloneBitmapArea
GdipGraphicsClear
GdipGetImagePixelFormat
GdipCreateHBITMAPFromBitmap
GdipCreateImageAttributes
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipCreateBitmapFromScan0
GdipDrawImageRectRectI
GdipLoadImageFromStream
GdiplusStartup
GdiplusShutdown
GdipCreateStringFormat
GdipDeleteBrush
GdipAlloc
GdipSetStringFormatLineAlign
GdipCreateFont
GdipCreateSolidFill
GdipSetStringFormatTrimming
GdipCreateFontFromLogfontW
GdipDrawLinesI

ws2_32

shutdown
ntohl
gethostname
ioctlsocket
sendto
recvfrom
gethostbyname
freeaddrinfo
getaddrinfo
listen
htonl
accept
select
__WSAFDIsSet
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
getservbyname
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
recv
WSAGetLastError
closesocket
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
WSAWaitForMultipleEvents

crypt32

CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertCloseStore

wldap32

ord45
ord211
ord46
ord217
ord143
ord41
ord35
ord79
ord30
ord200
ord301
ord50
ord22
ord60
ord27
ord26
ord33
ord32

normaliz

IdnToAscii

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 478KB - Virtual size: 477KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 538KB - Virtual size: 538KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f2d0553a338a86ebc3e7ab9cb8dfa4e7

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

01:ba:be:96:e5:0e:a2:5f:3f:0e:88:42:9a:74:a4:62Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

1b:c3:19:43:a2:bd:14:66:3d:e4:76:f5:c7:47:0d:20:fd:9f:3d:c7:6b:2b:1f:c0:cc:0e:41:d6:c8:1f:7b:d4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

comctl32

msimg32

gdiplus

ws2_32

crypt32

wldap32

normaliz

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 478KB - Virtual size: 477KB

.data Size: 54KB - Virtual size: 69KB

.rsrc Size: 538KB - Virtual size: 538KB

.reloc Size: 98KB - Virtual size: 97KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

01:ba:be:96:e5:0e:a2:5f:3f:0e:88:42:9a:74:a4:62
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

1b:c3:19:43:a2:bd:14:66:3d:e4:76:f5:c7:47:0d:20:fd:9f:3d:c7:6b:2b:1f:c0:cc:0e:41:d6:c8:1f:7b:d4
Signer

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 478KB - Virtual size: 477KB

.data
Size: 54KB - Virtual size: 69KB

.rsrc
Size: 538KB - Virtual size: 538KB

.reloc
Size: 98KB - Virtual size: 97KB