cryptbot | 2024-12-27_120f899289053184949709b5524ef019_avoslocker_luca-stealer_revil

Sharing

Copy URL Twitter E-mail

General

Target
2024-12-27_120f899289053184949709b5524ef019_avoslocker_luca-stealer_revil
Size 6.8MB
Sample241227-mdm2rstrhr
SHA256 1904bf697477c28d26ed8cacf1cb9dcacfe861b4da1d06b3c74de06da6b4e1fa
MD5 120f899289053184949709b5524ef019
SHA1 26fee9ca7514c655e3f2d085b2cbde61a5ee7cc2
SHA512 e6f1c490c2f64ebeba13fff25517dc5d381ea1711c59767d16a586839db5ae540cb02864828c8a4f71920fd23826b20db4a882428fde0caa25cb007766ce0d2c
SSDEEP 98304:tTIM/ZETCULkV2uzT3D3WdbJbOctdIknKQ1C:CMR9U42u7YO66knKQ1C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

cryptbot

Malware Config

Signatures

Cryptbot family
cryptbot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-12-27_120f899289053184949709b5524ef019_avoslocker_luca-stealer_revil

File Explorer

2024-12-27_120f899289053184949709b5524ef019_avoslocker_luca-stealer_revil

.exe 6.8MB

2024-12-27_120f899289053184949709b5524ef019_avoslocker_luca-stealer_revil

IMPHASH f97ec411ab12d3c2a370fc27ced08ea9
SHA256 1904bf697477c28d26ed8cacf1cb9dcacfe861b4da1d06b3c74de06da6b4e1fa
MD5 120f899289053184949709b5524ef019
SHA1 26fee9ca7514c655e3f2d085b2cbde61a5ee7cc2
SHA512 e6f1c490c2f64ebeba13fff25517dc5d381ea1711c59767d16a586839db5ae540cb02864828c8a4f71920fd23826b20db4a882428fde0caa25cb007766ce0d2c
SSDEEP 98304:tTIM/ZETCULkV2uzT3D3WdbJbOctdIknKQ1C:CMR9U42u7YO66knKQ1C
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3012868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetLastError FormatMessageA LoadLibraryExA SetLastError GetSystemTime SystemTimeToFileTime Sleep InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection GetSystemTimeAsFileTime GetTimeZoneInformation CloseHandle SetEvent ResetEvent CreateMutexW CreateEventW FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW WideCharToMultiByte FreeLibrary GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx LocalFree UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI GetStdHandle GetCurrentDirectoryA GetCurrentDirectoryW DuplicateHandle GetCurrentProcess GetVersionExA IsDBCSLeadByteEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead GetModuleHandleW IsDebuggerPresent GetStartupInfoW InitializeSRWLock AcquireSRWLockExclusive InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx GetStringTypeW GetCPInfo RtlUnwind RaiseException InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleOutputCP GetFileSizeEx SetConsoleCtrlHandler SetStdHandle FindClose FindFirstFileExW FindNextFileW GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW ExitProcess ReleaseSRWLockExclusive GetProcAddress GetWindowsDirectoryW SetCurrentDirectoryW LoadLibraryA GetModuleFileNameW GetModuleFileNameA IsValidCodePage SleepEx MoveFileExA DeviceIoControl RemoveDirectoryA GetFileAttributesExA CreateDirectoryA ReadConsoleA SetConsoleMode SwitchToFiber DeleteFiber CreateFiber FindFirstFileW GetEnvironmentVariableW ConvertFiberToThread ConvertThreadToFiber WaitForSingleObject

user32

GetUserObjectInformationW MessageBoxW GetProcessWindowStation MessageBoxA GetActiveWindow

ws2_32

ioctlsocket gethostbyname select WSAIoctl WSAGetLastError WSACleanup WSAStartup socket setsockopt send recv getsockopt getsockname connect closesocket WSASetLastError

secur32

FreeContextBuffer InitializeSecurityContextA FreeCredentialsHandle DeleteSecurityContext AcquireCredentialsHandleA

advapi32

CryptGenRandom RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryValueExA DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptAcquireContextA CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext GetUserNameA

shell32

SHGetFolderPathA

crypt32

CertEnumCertificatesInStore CertOpenStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertFindCertificateInStore CertCloseStore

bcrypt

BCryptGenRandom