C:\devel\Ark7\bin.win32\bdzsfx.x86.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-04_f85a9b72ca4cec652e8b9d9e83d9b119_avoslocker_cobalt-strike.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-04_f85a9b72ca4cec652e8b9d9e83d9b119_avoslocker_cobalt-strike.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-04_f85a9b72ca4cec652e8b9d9e83d9b119_avoslocker_cobalt-strike
-
Size
306KB
-
MD5
f85a9b72ca4cec652e8b9d9e83d9b119
-
SHA1
7c625acea576213343a42f090862d0d6112aeb78
-
SHA256
e17c2da99e9835a665ffcf26ce2280118b871c49310e3776dbdf6c9c63a5492e
-
SHA512
3ea3938e003b648ed8a7e055028e82da434208687697746bf50bb82c07377bf2814ecc7833868e651e56bab49e25f02ec63f08710dc4d69981571e1b5443675c
-
SSDEEP
6144:ECsuPVfAQEkeVMffwDwTdcxjX2z9+9CtWB4ustRVDIg5jU25lzvDxi9:f607YDwTdcxjX2z9uCt3ustRVsWt5lzM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-10-04_f85a9b72ca4cec652e8b9d9e83d9b119_avoslocker_cobalt-strike
Files
-
2024-10-04_f85a9b72ca4cec652e8b9d9e83d9b119_avoslocker_cobalt-strike.exe windows:6 windows x86 arch:x86
9668fa670179965985d6fa17fe7a20d9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
MultiByteToWideChar
SetFilePointer
GetLastError
GetVersion
DeleteFileW
VirtualAlloc
VirtualFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
CreateEventW
SetEvent
ResetEvent
InitializeCriticalSection
lstrcatW
lstrlenW
GetFileAttributesA
GetFileAttributesW
lstrcpyW
CreateDirectoryW
SetFileAttributesW
GetCurrentThread
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
Sleep
IsNormalizedString
NormalizeString
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateHardLinkW
RemoveDirectoryW
CreateSymbolicLinkW
GlobalMemoryStatusEx
SetEndOfFile
SetFileTime
CreateFileA
GetDriveTypeW
WriteFile
FlushFileBuffers
GetTickCount
WideCharToMultiByte
FindClose
GetModuleFileNameW
GlobalFree
GetProcAddress
LocalFree
GetModuleHandleW
lstrcmpiW
RaiseException
LoadLibraryExW
InitializeCriticalSectionEx
SetLastError
GetCurrentThreadId
GetUserDefaultLangID
DecodePointer
GetConsoleMode
GetConsoleCP
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
LCMapStringW
CompareStringW
SetFilePointerEx
GetStdHandle
WriteConsoleW
ExitProcess
GetCommandLineW
GetCommandLineA
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
GetFileSize
CloseHandle
CreateFileW
lstrcpynW
ReadFile
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemDirectoryW
FreeLibrary
LoadLibraryW
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
IsProcessorFeaturePresent
FlushInstructionCache
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
GetCurrentProcess
user32
ScreenToClient
GetWindowRect
SystemParametersInfoW
SendMessageW
CreateWindowExW
GetDlgItem
GetWindowTextLengthW
SetFocus
EndDialog
KillTimer
MoveWindow
EnableWindow
SetTimer
SetDlgItemTextW
PostMessageW
MessageBoxW
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetParent
MapWindowPoints
LoadIconW
SetWindowPos
GetWindowLongW
GetWindowTextW
SetWindowLongW
DialogBoxParamW
UnregisterClassW
GetActiveWindow
CharNextW
DispatchMessageW
TranslateMessage
PeekMessageW
RegisterWindowMessageW
SetWindowTextW
InvalidateRect
GetClientRect
gdi32
GetObjectW
GetStockObject
DeleteObject
CreateFontIndirectW
advapi32
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
AreAllAccessesGranted
AccessCheck
OpenThreadToken
RevertToSelf
ImpersonateSelf
GetFileSecurityW
shell32
SHGetPathFromIDListW
SHBrowseForFolderW
CommandLineToArgvW
ole32
CoTaskMemRealloc
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
oleaut32
VarUI4FromStr
shlwapi
PathIsDirectoryW
Sections
.text Size: 205KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ