Behavioral task
behavioral1
Sample
2024-12-27_120f899289053184949709b5524ef019_avoslocker_luca-stealer_revil.exe
Resource
win7-20240903-en
General
-
Target
2024-12-27_120f899289053184949709b5524ef019_avoslocker_luca-stealer_revil
-
Size
6.8MB
-
MD5
120f899289053184949709b5524ef019
-
SHA1
26fee9ca7514c655e3f2d085b2cbde61a5ee7cc2
-
SHA256
1904bf697477c28d26ed8cacf1cb9dcacfe861b4da1d06b3c74de06da6b4e1fa
-
SHA512
e6f1c490c2f64ebeba13fff25517dc5d381ea1711c59767d16a586839db5ae540cb02864828c8a4f71920fd23826b20db4a882428fde0caa25cb007766ce0d2c
-
SSDEEP
98304:tTIM/ZETCULkV2uzT3D3WdbJbOctdIknKQ1C:CMR9U42u7YO66knKQ1C
Malware Config
Signatures
-
Cryptbot family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-12-27_120f899289053184949709b5524ef019_avoslocker_luca-stealer_revil
Files
-
2024-12-27_120f899289053184949709b5524ef019_avoslocker_luca-stealer_revil.exe windows:6 windows x86 arch:x86
f97ec411ab12d3c2a370fc27ced08ea9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
GetLastError
FormatMessageA
LoadLibraryExA
SetLastError
GetSystemTime
SystemTimeToFileTime
Sleep
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
GetTimeZoneInformation
CloseHandle
SetEvent
ResetEvent
CreateMutexW
CreateEventW
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
WideCharToMultiByte
FreeLibrary
GetProcessHeap
GetCurrentProcessId
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
HeapReAlloc
DeleteFileW
DeleteFileA
WaitForSingleObjectEx
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetFileAttributesW
CreateFileW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
HeapFree
HeapCreate
ReadFile
AreFileApisANSI
GetStdHandle
GetCurrentDirectoryA
GetCurrentDirectoryW
DuplicateHandle
GetCurrentProcess
GetVersionExA
IsDBCSLeadByteEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
GetModuleHandleW
IsDebuggerPresent
GetStartupInfoW
InitializeSRWLock
AcquireSRWLockExclusive
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
GetCPInfo
RtlUnwind
RaiseException
InterlockedPushEntrySList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetFileSizeEx
SetConsoleCtrlHandler
SetStdHandle
FindClose
FindFirstFileExW
FindNextFileW
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
ExitProcess
ReleaseSRWLockExclusive
GetProcAddress
GetWindowsDirectoryW
SetCurrentDirectoryW
LoadLibraryA
GetModuleFileNameW
GetModuleFileNameA
IsValidCodePage
SleepEx
MoveFileExA
DeviceIoControl
RemoveDirectoryA
GetFileAttributesExA
CreateDirectoryA
ReadConsoleA
SetConsoleMode
SwitchToFiber
DeleteFiber
CreateFiber
FindFirstFileW
GetEnvironmentVariableW
ConvertFiberToThread
ConvertThreadToFiber
WaitForSingleObject
user32
GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
MessageBoxA
GetActiveWindow
ws2_32
ioctlsocket
gethostbyname
select
WSAIoctl
WSAGetLastError
WSACleanup
WSAStartup
socket
setsockopt
send
recv
getsockopt
getsockname
connect
closesocket
WSASetLastError
secur32
FreeContextBuffer
InitializeSecurityContextA
FreeCredentialsHandle
DeleteSecurityContext
AcquireCredentialsHandleA
advapi32
CryptGenRandom
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptAcquireContextA
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
GetUserNameA
shell32
SHGetFolderPathA
crypt32
CertEnumCertificatesInStore
CertOpenStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertFindCertificateInStore
CertCloseStore
bcrypt
BCryptGenRandom
Sections
.text Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 396KB - Virtual size: 396KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ