Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-19_03b9fa614f68e3015bc73fb72b9abe41_avoslocker_hijackloader_luca-stealer_rhadamanthys.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-12-19_03b9fa614f68e3015bc73fb72b9abe41_avoslocker_hijackloader_luca-stealer_rhadamanthys.exe
Resource
win10v2004-20241007-en
Target
2024-12-19_03b9fa614f68e3015bc73fb72b9abe41_avoslocker_hijackloader_luca-stealer_rhadamanthys
Size
10.0MB
MD5
03b9fa614f68e3015bc73fb72b9abe41
SHA1
2a188db911e4005083f4e8ec121435dd78bb485a
SHA256
49735d3992131f165199287d0b5997dfa8e035a10177ea556e957d3cac7a1cb4
SHA512
2da0f16a883388b0c84ca727eb40eeb1d60703d695e359b6bf16d8b0e43ab44d73acfda9c38343cd948df158017e90754e0f70fcea25cb48ad8c9587c90a56f0
SSDEEP
49152:NRr+LfDw1gczio6kW4jxnTs7ArxNWgZQNX:ufsjzi/ijxnTs7QxN2
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
E:\BuildAgent\work\53efeb3c1c1ac12a\win\Release\Client\Win32\sym\cyreport.pdb
RtlImageNtHeader
RtlImageDirectoryEntryToData
RtlFreeUnicodeString
RtlEqualSid
RtlInterlockedPopEntrySList
RtlInitializeSListHead
RtlQueryDepthSList
RtlInterlockedPushEntrySList
NtQueryPerformanceCounter
RtlInitUnicodeStringEx
RtlUnwind
RtlCopyUnicodeString
RtlConvertSidToUnicodeString
RtlAppendUnicodeToString
RtlCompareMemory
LdrUnlockLoaderLock
ZwFreeVirtualMemory
ZwProtectVirtualMemory
RtlClearBits
ZwAllocateVirtualMemory
LdrLockLoaderLock
ZwQueryVirtualMemory
RtlAreBitsSet
RtlAreBitsClear
RtlFindClearBits
ZwQueryObject
ZwDuplicateToken
RtlCreateSecurityDescriptor
RtlCreateAcl
RtlCopySid
RtlAbsoluteToSelfRelativeSD
ZwSetInformationThread
ZwQueryInformationToken
RtlLengthSid
RtlSetDaclSecurityDescriptor
ZwOpenProcessTokenEx
ZwOpenThreadTokenEx
RtlValidSid
RtlLengthSecurityDescriptor
RtlDosPathNameToNtPathName_U
RtlIntegerToUnicodeString
ZwQueryVolumeInformationFile
ZwDeviceIoControlFile
ZwQuerySystemInformation
ZwOpenFile
RtlInitAnsiString
RtlAppendUnicodeStringToString
RtlFreeHeap
NtProtectVirtualMemory
RtlAcquireResourceExclusive
RtlInitializeResource
RtlReleaseResource
RtlAcquireResourceShared
RtlDeleteResource
NtQueryVirtualMemory
RtlAllocateHeap
NtFlushInstructionCache
ZwOpenKey
ZwQueryValueKey
ZwEnumerateKey
RtlPrefixUnicodeString
ZwEnumerateValueKey
RtlGUIDFromString
ZwQueryKey
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlInitializeGenericTableAvl
ZwClose
ZwSetEvent
NtCreateKeyedEvent
ZwCreateEvent
ZwWaitForSingleObject
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlDeregisterWaitEx
RtlInitializeSRWLock
RtlCompareUnicodeString
RtlSetBits
RtlInitializeBitMap
ZwQueryInformationFile
ZwSetInformationFile
ZwQueryInformationProcess
RtlGetVersion
RtlLeaveCriticalSection
RtlEnterCriticalSection
ZwWriteFile
ZwReadFile
ZwDeleteFile
RtlInitializeCriticalSection
RtlStringFromGUID
ZwCreateFile
RtlNtStatusToDosError
RtlInitUnicodeString
RtlEqualUnicodeString
WinVerifyTrust
CryptCATAdminAcquireContext2
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminCalcHashFromFileHandle2
CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
NdrClientCall2
UuidToStringW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcStringFreeW
RpcBindingFree
UuidCreate
MiniDumpWriteDump
SHCreateStreamOnFileW
RegGetValueA
OpenThreadToken
TraceMessageVa
ConvertSidToStringSidW
CreateProcessAsUserW
CloseServiceHandle
OpenSCManagerW
EnumServicesStatusExW
OpenProcessToken
DuplicateTokenEx
GetTokenInformation
RegSaveKeyExW
LookupAccountSidW
RevertToSelf
RegCloseKey
ImpersonateLoggedOnUser
RegOpenKeyExW
RegQueryValueExW
DeregisterEventSource
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
RegisterEventSourceW
ReportEventW
wsprintfW
GetUserObjectInformationW
GetModuleHandleExW
ExitProcess
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedPushEntrySList
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
LCMapStringEx
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetConsoleMode
GetCurrentThreadId
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
InitOnceBeginInitialize
InitOnceComplete
LoadLibraryExA
FreeLibrary
VirtualQuery
VirtualProtect
GetSystemInfo
RaiseException
WideCharToMultiByte
MultiByteToWideChar
WriteFile
GetFileType
GetStdHandle
GetModuleHandleA
GetEnvironmentVariableA
ReadFile
CreateFileW
GetCurrentThread
GetThreadLocale
MapViewOfFile
GetTimeZoneInformation
OpenFileMappingW
GetCommandLineW
CreateThread
WaitForSingleObjectEx
DeleteFileW
OpenProcess
DuplicateHandle
GetProcessTimes
FormatMessageW
LocalAlloc
VirtualFree
SetLastError
GetModuleHandleW
GetProcAddress
Sleep
WaitForSingleObject
VirtualAlloc
GetCurrentProcess
CancelIo
GetProcessHeap
ReadProcessMemory
HeapAlloc
ResetEvent
CloseHandle
CreateEventW
GetConsoleCP
GetModuleFileNameW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetFileSizeEx
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
WriteConsoleW
GetStringTypeW
LeaveCriticalSection
WaitForMultipleObjects
EnterCriticalSection
GetLastError
FindFirstFileW
FindNextFileW
FindClose
LocalFree
TerminateProcess
ResumeThread
SetEvent
TerminateThread
HeapFree
CommandLineToArgvW
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore
CertGetCertificateContextProperty
CertGetNameStringW
CertCloseStore
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ