C:\veryfast\AppStore\engine\Release\fa_rss.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-15_d841ebefc153dbafdd9d8989f9fb0b79_avoslocker_cobalt-strike.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-15_d841ebefc153dbafdd9d8989f9fb0b79_avoslocker_cobalt-strike.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-15_d841ebefc153dbafdd9d8989f9fb0b79_avoslocker_cobalt-strike
-
Size
590KB
-
MD5
d841ebefc153dbafdd9d8989f9fb0b79
-
SHA1
eaf086a6e0d6bf67170ab4669a781284af2f65e3
-
SHA256
0e1b06ceee564b9ccd6f7aacc7acac585c2776cac90c458355db2cdfca8765ed
-
SHA512
041c4fb6de2ebb25f8a150ac9503c164b31ea6c5359385d22c89de673f360ebec69e9b6a710a61345342a1cfab1118b86083ff9b5e4f065a6edfb78f820fbfb1
-
SSDEEP
12288:ZB1/rPkVE7NYwq9Eo/mSrY52PHCst5tgkiKd/wNNSphcN4tn:d/rWE7NYw+7lNt5xia4NCgQn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-10-15_d841ebefc153dbafdd9d8989f9fb0b79_avoslocker_cobalt-strike
Files
-
2024-10-15_d841ebefc153dbafdd9d8989f9fb0b79_avoslocker_cobalt-strike.exe windows:6 windows x86 arch:x86
94a4b9dd8724d5e09c5e447af1d7ec30
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
urlmon
URLDownloadToFileW
kernel32
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
GetTickCount
Sleep
GetModuleFileNameW
TerminateProcess
OpenProcess
CloseHandle
WideCharToMultiByte
GetCurrentDirectoryW
DeleteFileW
GetProcAddress
GetModuleHandleA
CreateEventW
SetLastError
GetLastError
WaitForMultipleObjects
ReadFile
WaitForSingleObjectEx
GetOverlappedResult
CreateNamedPipeW
ConnectNamedPipe
SetEvent
CreateDirectoryW
GetCommandLineW
LocalFree
OpenEventW
GetCurrentProcess
GlobalAlloc
GlobalFree
K32EnumProcesses
QueryFullProcessImageNameW
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
HeapSize
WriteFile
GetCPInfo
CompareStringEx
GetLocaleInfoEx
SetEndOfFile
WriteConsoleW
CreateFileW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetFileSizeEx
GetFileType
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
ResetEvent
GetStdHandle
FreeLibraryAndExitThread
ResumeThread
ExitThread
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
CreateThread
GetModuleHandleExW
ExitProcess
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
FormatMessageA
GetStringTypeW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryEnterCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
EncodePointer
LCMapStringEx
GetSystemTimeAsFileTime
user32
GetWindowThreadProcessId
GetCursorPos
WindowFromPoint
InsertMenuW
SetForegroundWindow
TrackPopupMenu
DestroyWindow
GetPhysicalCursorPos
GetAsyncKeyState
GetSystemMetrics
CreatePopupMenu
DefWindowProcW
PostQuitMessage
LoadIconW
wsprintfW
MessageBoxW
SystemParametersInfoW
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
RegisterClassExW
winspool.drv
EnumPrintersW
advapi32
RegNotifyChangeKeyValue
RegSetKeyValueW
RegCreateKeyW
RegCloseKey
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
shell32
CommandLineToArgvW
Shell_NotifyIconW
ShellExecuteW
ole32
CoInitialize
CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
SysFreeString
SysAllocString
VariantClear
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
shlwapi
PathFindFileNameW
Sections
.text Size: 431KB - Virtual size: 430KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 110KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ