2024-11-09_27d032411a42c6ba2d04dd91bf4020c1_avoslocker_luca-stealer

General

Target
2024-11-09_27d032411a42c6ba2d04dd91bf4020c1_avoslocker_luca-stealer
Size 4.4MB
Sample241109-ngjzystdje
SHA256 e35ed71c2af051bcfa338a2595f1b30f310bfc20502d9389c933e28a538f5bd3
MD5 27d032411a42c6ba2d04dd91bf4020c1
SHA1 e6da3bd169288d1f0dfdb5efd78d15c2c854c0f8
SHA512 8b5ceb5915bfdbba6ab6bc64734cfa3c1c638e60a9b60404b442733717abbddcc234f080b35be6c42b4ac8654b958ee99a4259bb8a9d6784f317bca42542e0bf
SSDEEP 98304:iWqq+Mb+KyWv5rIy5YFWAvwznaTfyYsVQqEuV6xAdznfAW3cnw:iWaLWvpIy5YPvwznZNQqEuVeKL3cw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-11-09_27d032411a42c6ba2d04dd91bf4020c1_avoslocker_luca-stealer

File Explorer

2024-11-09_27d032411a42c6ba2d04dd91bf4020c1_avoslocker_luca-stealer

.exe 4.4MB

2024-11-09_27d032411a42c6ba2d04dd91bf4020c1_avoslocker_luca-stealer

IMPHASH 116f2fb15b37440cc860b72ed33c8f16
SHA256 e35ed71c2af051bcfa338a2595f1b30f310bfc20502d9389c933e28a538f5bd3
MD5 27d032411a42c6ba2d04dd91bf4020c1
SHA1 e6da3bd169288d1f0dfdb5efd78d15c2c854c0f8
SHA512 8b5ceb5915bfdbba6ab6bc64734cfa3c1c638e60a9b60404b442733717abbddcc234f080b35be6c42b4ac8654b958ee99a4259bb8a9d6784f317bca42542e0bf
SSDEEP 98304:iWqq+Mb+KyWv5rIy5YFWAvwznaTfyYsVQqEuV6xAdznfAW3cnw:iWaLWvpIy5YPvwznZNQqEuVeKL3cw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\a\b\d_00000000_\b\out\Win32\Release\starter.pdb

kernel32

EnterCriticalSection LeaveCriticalSection InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent CloseHandle ResetEvent DeleteCriticalSection LocalAlloc OpenProcess DeleteFileW RemoveDirectoryW GetModuleFileNameW GetLastError CreateDirectoryW CompareStringW GetTempPathW ExpandEnvironmentStringsW CreateProcessW CreateFileW GetSystemWindowsDirectoryW GetExitCodeProcess GetCurrentProcessId ReadFile FormatMessageW GetModuleHandleW GetFileAttributesW SetCurrentDirectoryW LoadLibraryExW GetProcAddress FreeLibrary LocalFree HeapFree GetProcessHeap MultiByteToWideChar GetSystemDirectoryW GetSystemWow64DirectoryW GetModuleHandleA GetCurrentProcess GetCurrentDirectoryW MoveFileW HeapAlloc RaiseException GetCurrentThreadId Sleep GetModuleHandleExW GetLocalTime SetUnhandledExceptionFilter SetEnvironmentVariableW GetWindowsDirectoryW GetLongPathNameW LoadLibraryW SetDllDirectoryW SetLastError TlsSetValue VirtualProtect VirtualAlloc TlsAlloc GetSystemInfo FlushInstructionCache TlsGetValue TlsFree GetTickCount VirtualQuery LoadLibraryExA FindResourceExW LoadResource LockResource SizeofResource WriteFile GetModuleFileNameA GetModuleHandleExA SetFilePointer FindNextFileW FindClose MoveFileExW GetTempFileNameW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW FormatMessageA FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle SetFilePointerEx AreFileApisANSI CopyFileW GetFileInformationByHandleEx WideCharToMultiByte GetStringTypeW QueryPerformanceCounter GetSystemTimeAsFileTime WaitForSingleObjectEx EncodePointer DecodePointer LCMapStringEx GetCPInfo InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetStdHandle LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW

Name

.text

Size

243KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2024-11-09_27d032411a42c6ba2d04dd91bf4020c1_avoslocker_luca-stealer

kernel32

generic