Static task
static1
Behavioral task
behavioral1
Sample
2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe
Resource
win7-20240903-en
General
-
Target
2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi
-
Size
12.1MB
-
MD5
e9fc2381cfd60a5353b73e6c394b5caf
-
SHA1
61c84c9282eb870315e40992b45c65d9936cf84f
-
SHA256
f11968df196f1c4fa3be918636fff4a8068c26e3a1fd72a51122ca23585659c9
-
SHA512
e0b5bed3093db2351bf9df49955f8a49584601d01d0393910d192584daec9a7d423c2df0580aa68d0b1e4aa32e627024bd1fab3722a47b8f120b40acdb2a7cee
-
SSDEEP
196608:KqqKNdE37uPvvyqOnkhJsv6tWKFdu9Cie9GJ:KqqKNIC3bOSJsv6tWKFdu9Cdy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi
Files
-
2024-12-04_e9fc2381cfd60a5353b73e6c394b5caf_avoslocker_luca-stealer_revil_wapomi.exe windows:5 windows x86 arch:x86
5759d23666945091274333214a2a69cc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleFileNameExA
GetProcessImageFileNameA
kernel32
GetConsoleMode
SetFileAttributesW
GetOEMCP
ExitThread
GetCommandLineA
GetConsoleCP
SetConsoleCtrlHandler
GetCPInfo
SetStdHandle
ExpandEnvironmentStringsW
IsValidLocale
IsValidLanguageGroup
FormatMessageW
LocalFree
GetModuleHandleW
GetCurrentThreadId
lstrcmpW
GetDriveTypeW
GetLongPathNameW
GetProcAddress
GetVolumeInformationW
FindAtomW
AddAtomW
DeleteAtom
CreateProcessA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
CreateFileA
GetFileInformationByHandle
GetFileType
GetFullPathNameW
ReadConsoleW
HeapAlloc
HeapFree
EnumSystemLocalesW
HeapReAlloc
GetStringTypeW
DecodePointer
GetFileSizeEx
SetConsoleMode
ReadConsoleInputW
SetEnvironmentVariableW
GetProcessHeap
WriteConsoleW
HeapSize
ReadFile
WriteFile
PeekNamedPipe
GetExitCodeProcess
Sleep
GetStdHandle
SearchPathA
DuplicateHandle
SetHandleInformation
CreatePipe
SetErrorMode
LoadLibraryExW
EncodePointer
RtlUnwind
RaiseException
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
VirtualFree
VirtualAlloc
CreateMutexW
ReleaseMutex
GetUserGeoID
GetGeoInfoW
GetTimeZoneInformation
WriteFileEx
SleepEx
CancelIo
ReadFileEx
GetModuleHandleExW
FindNextFileW
FindFirstFileExW
FindNextChangeNotification
GetACP
IsValidCodePage
WideCharToMultiByte
MultiByteToWideChar
GetTempPathW
GetFileAttributesW
CreateFileW
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcatA
lstrcmpA
OpenProcess
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
GetLastError
CloseHandle
GetFullPathNameA
SetFileAttributesA
GetFileAttributesA
FreeLibraryAndExitThread
FindFirstChangeNotificationW
FindCloseChangeNotification
GetModuleFileNameW
GetStartupInfoW
GetProcessId
CreateNamedPipeW
ConnectNamedPipe
SetFilePointer
FreeEnvironmentStringsW
GetEnvironmentStringsW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
MoveFileW
CopyFileW
DeviceIoControl
RemoveDirectoryW
FindFirstFileW
FindClose
DeleteFileW
CreateDirectoryW
GetCurrentDirectoryW
MoveFileExW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
SetFilePointerEx
SetEndOfFile
GetLogicalDrives
FlushFileBuffers
GetUserDefaultUILanguage
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
ResetEvent
LCMapStringW
GetSystemDirectoryW
QueryPerformanceFrequency
WaitForSingleObjectEx
GetFileAttributesExW
GetSystemInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
TerminateThread
GetThreadPriority
SetThreadPriority
GetCurrentThread
CreateThread
SwitchToThread
CreateProcessW
WaitForSingleObject
SetEvent
GetLocalTime
OutputDebugStringW
GetCommandLineW
GetUserDefaultLCID
CompareStringW
SystemTimeToFileTime
GetSystemTime
SetLastError
FlushConsoleInputBuffer
GlobalMemoryStatus
FreeLibrary
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
WaitForMultipleObjects
CreateEventW
LoadLibraryW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
ExitProcess
GetConsoleWindow
GlobalSize
LoadLibraryA
GetLocaleInfoW
CheckRemoteDebuggerPresent
GetUserDefaultLangID
ole32
CoLockObjectExternal
RegisterDragDrop
CoUninitialize
StringFromGUID2
RevokeDragDrop
OleInitialize
OleUninitialize
OleSetMenuDescriptor
StgOpenStorageOnILockBytes
CoTaskMemFree
CreateStreamOnHGlobal
OleCreateFromFile
CreateILockBytesOnHGlobal
OleLockRunning
CLSIDFromProgID
CoCreateInstance
CoFreeUnusedLibraries
CoGetClassObject
CoInitialize
CoCreateGuid
OleSetClipboard
OleGetClipboard
OleFlushClipboard
OleIsCurrentClipboard
DoDragDrop
ReleaseStgMedium
CoGetMalloc
CoTaskMemAlloc
StgCreateDocfileOnILockBytes
OleRun
imm32
ImmGetVirtualKey
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmNotifyIME
ImmGetDefaultIMEWnd
ImmGetContext
winmm
PlaySoundW
oleaut32
VariantChangeType
SysStringLen
SysAllocString
VariantClear
OleCreatePictureIndirect
OleCreateFontIndirect
SafeArrayCreateVector
SafeArrayGetVartype
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetDim
SafeArrayDestroy
SafeArrayCreate
VariantTimeToSystemTime
SystemTimeToVariantTime
GetActiveObject
LoadTypeLi
VariantInit
SysFreeString
SysAllocStringLen
shell32
SHGetPathFromIDListW
SHGetMalloc
ShellExecuteW
SHGetFileInfoW
ord680
SHGetSpecialFolderPathA
ShellExecuteExA
CommandLineToArgvW
SHGetSpecialFolderPathW
SHBrowseForFolderW
gdi32
DeleteDC
DeleteObject
SelectObject
CombineRgn
GetDIBits
CreateBitmap
ExtTextOutW
SetWorldTransform
SetTextAlign
SetTextColor
SetGraphicsMode
SetBkMode
GetCharABCWidthsI
GetTextExtentPoint32W
GetOutlineTextMetricsW
GetGlyphOutlineW
GetCharABCWidthsFloatW
GetCharABCWidthsW
GetBitmapBits
SwapBuffers
SetPixelFormat
GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
CreateRectRgn
GetDeviceCaps
GetRegionData
SelectClipRgn
CreateDIBSection
CreateCompatibleDC
GdiFlush
BitBlt
OffsetRgn
CreateCompatibleBitmap
GetTextFaceW
GetObjectW
GetTextMetricsW
RemoveFontMemResourceEx
AddFontMemResourceEx
RemoveFontResourceExW
EnumFontFamiliesExW
AddFontResourceExW
GetStockObject
GetFontData
CreateFontIndirectW
CreateDCW
iphlpapi
GetAdaptersAddresses
GetAdaptersInfo
ws2_32
getsockopt
htonl
gethostbyname
WSAGetLastError
__WSAFDIsSet
ntohl
closesocket
getpeername
getsockname
htons
listen
inet_addr
bind
WSASocketW
WSASendTo
WSASend
WSARecvFrom
WSARecv
WSANtohs
WSANtohl
WSAIoctl
WSAHtonl
WSAConnect
WSAAccept
WSASetLastError
shutdown
send
recv
WSAAsyncSelect
WSACleanup
WSAStartup
gethostname
select
setsockopt
gethostbyaddr
advapi32
GetTokenInformation
RegQueryInfoKeyW
CryptEnumProvidersA
CryptSignHashA
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventA
RegisterEventSourceA
DeregisterEventSource
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptReleaseContext
CryptAcquireContextA
RegFlushKey
OpenProcessToken
RegSetValueExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
GetLengthSid
FreeSid
CopySid
user32
RegisterClassW
GetCursorInfo
GetIconInfo
CreateIconIndirect
CreateCursor
LoadCursorW
GetCursor
SetCursorPos
NotifyWinEvent
SetMenuItemInfoW
TrackPopupMenuEx
GetMenu
MapVirtualKeyW
ToUnicode
ToAscii
GetKeyboardState
IsZoomed
PeekMessageW
SetCaretPos
HideCaret
DestroyCaret
CreateCaret
RegisterWindowMessageW
GetKeyboardLayout
GetAsyncKeyState
RegisterClipboardFormatW
ChangeClipboardChain
SetClipboardViewer
LoadIconW
EnumDisplayMonitors
GetMonitorInfoW
LoadImageW
GetSysColorBrush
ChildWindowFromPointEx
GetCursorPos
GetFocus
RegisterClassExW
GetClassInfoW
UnregisterClassW
GetKeyboardLayoutList
GetAncestor
DestroyIcon
DestroyCursor
SetParent
SetWindowLongW
ScreenToClient
ClientToScreen
SetCursor
AdjustWindowRectEx
GetWindowRect
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
SetForegroundWindow
ReleaseCapture
GetClipboardFormatNameW
GetCapture
SetFocus
IsIconic
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
SetWindowPos
MoveWindow
FlashWindowEx
ShowWindow
IsChild
CreateWindowExW
AttachThreadInput
GetDesktopWindow
GetCaretBlinkTime
MessageBeep
IsWindow
GetDoubleClickTime
SetWindowRgn
DestroyWindow
DefWindowProcW
SystemParametersInfoW
GetSysColor
GetSystemMetrics
EnableMenuItem
GetSystemMenu
ReleaseDC
GetDC
GetParent
GetWindowLongW
GetClientRect
GetMenuItemInfoW
GetMenuItemCount
IsWindowEnabled
SetWindowTextW
GetKeyState
PostMessageW
SendMessageW
GetMessagePos
WaitForInputIdle
GetWindow
GetWindowThreadProcessId
GetClassNameA
GetWindowTextA
GetForegroundWindow
TrackMouseEvent
CharNextExA
PostThreadMessageW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
KillTimer
SetTimer
MsgWaitForMultipleObjectsEx
GetQueueStatus
DispatchMessageW
TranslateMessage
GetMessageExtraInfo
GetWindowTextW
EnumWindows
RealGetWindowClassW
MessageBoxW
DrawIconEx
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxA
SetCapture
EnableWindow
crypt32
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertGetCertificateChain
CertCreateCertificateContext
CertFreeCertificateContext
CertFreeCertificateChain
Sections
.text Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3.7MB - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 147KB - Virtual size: 203KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qtmetad Size: 512B - Virtual size: 272B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 292B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 189KB - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 273KB - Virtual size: 273KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
>B�J�u2 Size: 16KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE