Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-09_bfd40588d2b83e2272109e963a2ee750_avoslocker_hijackloader_revil.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-09_bfd40588d2b83e2272109e963a2ee750_avoslocker_hijackloader_revil.exe
Resource
win10v2004-20241007-en
Target
2024-10-09_bfd40588d2b83e2272109e963a2ee750_avoslocker_hijackloader_revil
Size
4.2MB
MD5
bfd40588d2b83e2272109e963a2ee750
SHA1
62e4059da59cfe1a03aaee38012b967bba5f2d0f
SHA256
05467daff176dac2c907e3b64bad882fa22cd80c2c60c6cbf916f2aa2d01c883
SHA512
052881dcc01e3c1e5e4bffd81da237952785c0873c4f173ace3ca5723d3a6a22dc24d908cddd55a1b4c17be1192ea2660e86296468591540536fa250c133b7b9
SSDEEP
98304:+6voCB4MRoDYg4Ysxh59AF+IBpgXyhWVZAXYAXkxDQXf/Ud0IYNO66/aGrIFSdvj:roCB4MRoDYg4Ysxh59AF+IBpgXyCZAXO
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
d:\Webhost\06-10-2024\WindowsBuilds\MYCOMPUTER_ACTIVEX\9217875\mycomp\mycomp\DesktopCentral\ZohoMeetingApp\ZAAudio\ZAAudioClient\bin\Win32\Release\ZAAudioClient.pdb
getpeername
bind
accept
ntohs
WSACleanup
WSAStartup
WSARecv
WSARecvFrom
WSASend
WSASendTo
ntohl
getaddrinfo
getsockopt
listen
recv
recvfrom
freeaddrinfo
ioctlsocket
htons
connect
socket
inet_addr
closesocket
WSAIoctl
send
sendto
WSASetLastError
getsockname
setsockopt
shutdown
WSAGetLastError
CertFreeCertificateChain
CertCloseStore
CertEnumCertificatesInStore
CertVerifyCertificateChainPolicy
CertOpenSystemStoreW
CertGetNameStringA
CertGetCertificateChain
CertCreateCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
CreateMutexW
LocalAlloc
ProcessIdToSessionId
FormatMessageW
GlobalAlloc
GlobalFree
CloseHandle
LocalFree
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
CreateEventW
SetEvent
CreateEventExW
SetThreadPriority
WaitForSingleObject
GetCurrentThread
CreateThread
ResetEvent
Sleep
SetLastError
GetCommandLineW
GetCurrentProcess
InitializeCriticalSection
MoveFileW
InterlockedDecrement
GetExitCodeThread
GetCurrentProcessId
CancelSynchronousIo
OpenEventW
ReadFile
WriteFile
FlushFileBuffers
CreateFileW
GetModuleFileNameW
CreateDirectoryW
WideCharToMultiByte
DeleteCriticalSection
MultiByteToWideChar
GetCurrentThreadId
GetProcessHeap
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
HeapReAlloc
LockResource
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
SizeofResource
ReadConsoleA
SetConsoleMode
LoadLibraryA
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SwitchToFiber
SystemTimeToFileTime
GetSystemTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetConsoleCtrlHandler
SetStdHandle
ReadConsoleW
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
ExitThread
GetCommandLineA
ExitProcess
WriteConsoleW
GetFileType
GetConsoleMode
GetConsoleCP
SetFilePointerEx
RtlUnwind
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
FormatMessageA
WaitForSingleObjectEx
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetStringTypeW
QueryPerformanceFrequency
EncodePointer
QueueUserWorkItem
GetModuleHandleExW
DuplicateHandle
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
CreateTimerQueue
SignalObjectAndWait
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
SetFilePointer
GetTimeZoneInformation
GetEnvironmentVariableW
SetEnvironmentVariableW
GetComputerNameW
GetCurrentDirectoryW
GetLongPathNameW
GetSystemDirectoryW
GetStdHandle
DeleteFileW
GetFileAttributesW
GetFileAttributesExW
RemoveDirectoryW
SetEndOfFile
MoveFileExW
FindClose
FindFirstFileW
FindNextFileW
ReleaseMutex
GetHandleInformation
CreateIoCompletionPort
GetQueuedCompletionStatusEx
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitOnceExecuteOnce
GetTickCount64
SetFileCompletionNotificationModes
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
CryptGenRandom
CryptDestroyHash
CryptCreateHash
GetTokenInformation
ConvertSidToStringSidW
InitializeSecurityDescriptor
FreeSid
OpenProcessToken
CreateWellKnownSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
DeregisterEventSource
RegisterEventSourceW
CryptEnumProvidersW
ReportEventW
CryptSignHashW
CommandLineToArgvW
SHGetFolderPathW
PropVariantClear
CoTaskMemFree
CoInitializeEx
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
PathFileExistsW
PathIsDirectoryW
PathRemoveFileSpecW
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsW
BCryptGenRandom
??0ClientConnection@Connection@@QAE@$$QAV01@@Z
??0ClientConnection@Connection@@QAE@ABV01@@Z
??0ClientConnection@Connection@@QAE@XZ
??0HttpClient@0HttpHandler@@QAE@$$QAV001@@Z
??0HttpClient@0HttpHandler@@QAE@ABV001@@Z
??0HttpClient@0HttpHandler@@QAE@XZ
??0dcSocket@ClientSocket@SocketUtils@@QAE@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N1@Z
??0dcSocket@ClientSocket@SocketUtils@@QAE@XZ
??0dcWebSocket@ClientSocket@SocketUtils@@QAE@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_N001@Z
??0dcWebSocket@ClientSocket@SocketUtils@@QAE@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_N0@Z
??0dcWebSocket@ClientSocket@SocketUtils@@QAE@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_N0H000@Z
??0dcWebSocket@ClientSocket@SocketUtils@@QAE@XZ
??0socketWrapper@ClientSocket@SocketUtils@@QAE@ABV012@@Z
??0socketWrapper@ClientSocket@SocketUtils@@QAE@XZ
??1ClientConnection@Connection@@QAE@XZ
??1HttpClient@0HttpHandler@@QAE@XZ
??1dcSocket@ClientSocket@SocketUtils@@UAE@XZ
??1dcWebSocket@ClientSocket@SocketUtils@@UAE@XZ
??1socketWrapper@ClientSocket@SocketUtils@@UAE@XZ
??4ClientConnection@Connection@@QAEAAV01@$$QAV01@@Z
??4ClientConnection@Connection@@QAEAAV01@ABV01@@Z
??4HttpClient@0HttpHandler@@QAEAAV001@$$QAV001@@Z
??4HttpClient@0HttpHandler@@QAEAAV001@ABV001@@Z
??4socketWrapper@ClientSocket@SocketUtils@@QAEAAV012@ABV012@@Z
??_7ClientConnection@Connection@@6B@
??_7HttpClient@0HttpHandler@@6B@
??_7dcSocket@ClientSocket@SocketUtils@@6BClientConnection@Connection@@@
??_7dcSocket@ClientSocket@SocketUtils@@6BIReferenceCounter@@@
??_7dcWebSocket@ClientSocket@SocketUtils@@6B@
??_7dcWebSocket@ClientSocket@SocketUtils@@6BClientConnection@Connection@@@
??_7dcWebSocket@ClientSocket@SocketUtils@@6BIReferenceCounter@@@
??_7socketWrapper@ClientSocket@SocketUtils@@6BClientConnection@Connection@@@
??_7socketWrapper@ClientSocket@SocketUtils@@6BIReferenceCounter@@@
?DestroySocket@dcSocket@ClientSocket@SocketUtils@@UAEXXZ
?InitSDPOffer@dcWebSocket@ClientSocket@SocketUtils@@UAE_NXZ
?checkSenderThreadStatus@dcSocket@ClientSocket@SocketUtils@@MAE_NXZ
?cleanup@dcWebSocket@ClientSocket@SocketUtils@@UAEXXZ
?close@dcWebSocket@ClientSocket@SocketUtils@@UAEXXZ
?connect@dcWebSocket@ClientSocket@SocketUtils@@UAE_NXZ
?connectViaProxy@dcWebSocket@ClientSocket@SocketUtils@@UAE_NXZ
?getConnectedInterfaceID@socketWrapper@ClientSocket@SocketUtils@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getIsCertValidationNeeded@socketWrapper@ClientSocket@SocketUtils@@UAE_NXZ
?getIsSystemMode@socketWrapper@ClientSocket@SocketUtils@@UAE_NXZ
?getLastError@socketWrapper@ClientSocket@SocketUtils@@UAEHXZ
?getLastErrorMsg@socketWrapper@ClientSocket@SocketUtils@@UAEAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getProxyHostName@socketWrapper@ClientSocket@SocketUtils@@UAEAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getProxyPassword@socketWrapper@ClientSocket@SocketUtils@@UAEAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getProxyPort@socketWrapper@ClientSocket@SocketUtils@@UAEHXZ
?getProxyUserName@socketWrapper@ClientSocket@SocketUtils@@UAEAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getServerHostName@socketWrapper@ClientSocket@SocketUtils@@UAEAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getServerPort@socketWrapper@ClientSocket@SocketUtils@@UAEHXZ
?initSocketConfigurations@dcWebSocket@ClientSocket@SocketUtils@@AAE_NXZ
?initialize@dcWebSocket@ClientSocket@SocketUtils@@UAEXXZ
?isProxyEnabled@socketWrapper@ClientSocket@SocketUtils@@UAE_NXZ
?isSecureMode@socketWrapper@ClientSocket@SocketUtils@@UAE_NXZ
?isSocketLive@dcWebSocket@ClientSocket@SocketUtils@@UAE_NXZ
?receiveBytes@dcWebSocket@ClientSocket@SocketUtils@@UAEHPAEH@Z
?receiveString@dcWebSocket@ClientSocket@SocketUtils@@UAEHPADH@Z
?sendBytes@dcWebSocket@ClientSocket@SocketUtils@@UAEHPAEH@Z
?sendBytesAsync@dcSocket@ClientSocket@SocketUtils@@UAE_NPAEH@Z
?sendFrameAsync@dcSocket@ClientSocket@SocketUtils@@UAEXAAV?$SmartPtr@VDataFrame@@@@@Z
?sendString@dcWebSocket@ClientSocket@SocketUtils@@UAEHPAD@Z
?sendString@dcWebSocket@ClientSocket@SocketUtils@@UAEHPADH@Z
?sendStringAsync@dcSocket@ClientSocket@SocketUtils@@UAE_NPAD@Z
?sendStringAsync@dcSocket@ClientSocket@SocketUtils@@UAE_NPADH@Z
?sendVectorAsync@dcSocket@ClientSocket@SocketUtils@@UAEXAAV?$vector@DV?$allocator@D@std@@@std@@@Z
?setCandidate@dcWebSocket@ClientSocket@SocketUtils@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setCandidateReceiver@dcWebSocket@ClientSocket@SocketUtils@@UAE_NP6A_NPAD@Z@Z
?setConnectionDetails@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_N0H00_J@Z
?setConnectionDetails@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H_N@Z
?setConnectionMode@socketWrapper@ClientSocket@SocketUtils@@UAEX_N@Z
?setDataChannelStateReceiver@dcWebSocket@ClientSocket@SocketUtils@@UAE_NP6A_NPAD@Z@Z
?setErrorReceiver@dcWebSocket@ClientSocket@SocketUtils@@UAE_NP6A_NHPBD@Z@Z
?setIsCertValidationNeeded@socketWrapper@ClientSocket@SocketUtils@@UAEX_N@Z
?setIsSystemMode@socketWrapper@ClientSocket@SocketUtils@@UAEX_N@Z
?setLastError@dcSocket@ClientSocket@SocketUtils@@MAEXH@Z
?setLastError@dcSocket@ClientSocket@SocketUtils@@MAEXHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setLastError@socketWrapper@ClientSocket@SocketUtils@@MAEXH@Z
?setLastError@socketWrapper@ClientSocket@SocketUtils@@MAEXHAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setLastWinErrorCode@socketWrapper@ClientSocket@SocketUtils@@MAEXH@Z
?setLoggerConfigurations@dcSocket@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?setPocoObjectReferences@dcWebSocket@ClientSocket@SocketUtils@@AAEXXZ
?setProxyDetails@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@H00@Z
?setProxyHostName@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setProxyPassword@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setProxyPort@socketWrapper@ClientSocket@SocketUtils@@UAEXH@Z
?setProxySwitch@socketWrapper@ClientSocket@SocketUtils@@UAEX_N@Z
?setProxyUserName@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setSDPHandShakeMessage@dcWebSocket@ClientSocket@SocketUtils@@UAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setSDPReceiver@dcWebSocket@ClientSocket@SocketUtils@@UAE_NP6A_NPAD@Z@Z
?setServerEndpoint@dcSocket@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setServerHostName@socketWrapper@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?setServerPort@socketWrapper@ClientSocket@SocketUtils@@UAEXH@Z
?setTurnInfo@dcWebSocket@ClientSocket@SocketUtils@@UAEXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00@Z
?shutDownSocket@dcWebSocket@ClientSocket@SocketUtils@@UAEXXZ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ