Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
2025-02-04_fa5594e6a6ea3d5c4dbc228a7621124b_avoslocker_luca-stealer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-02-04_fa5594e6a6ea3d5c4dbc228a7621124b_avoslocker_luca-stealer.exe
Resource
win10v2004-20250129-en
General
-
Target
2025-02-04_fa5594e6a6ea3d5c4dbc228a7621124b_avoslocker_luca-stealer
-
Size
17.0MB
-
MD5
fa5594e6a6ea3d5c4dbc228a7621124b
-
SHA1
f130435b6e6826156c7a443c5ec71c4bb93aa76b
-
SHA256
39b7c27d3a448a7f8250c844157f8ce688d0f772dce96cc69dde9a659a32f204
-
SHA512
e94d4d24352c647c3af76eba2dfb5fecf8e2f681a4b4aadee96a3da4175cda0b52dfa0be5f5e924afad90ca90a797ba092268a09f27ba65d344c33b734a00bee
-
SSDEEP
12288:yEamjuc7E2c+nf2pXyfPpYmMrFtZGC14qlYCebmyIOz:yEamjuc7tc+nf2pCJk5GChK1b4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-02-04_fa5594e6a6ea3d5c4dbc228a7621124b_avoslocker_luca-stealer
Files
-
2025-02-04_fa5594e6a6ea3d5c4dbc228a7621124b_avoslocker_luca-stealer.exe windows:6 windows x86 arch:x86
ee0f04388718cc39612130a7342bdc21
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
RegisterTouchWindow
DragDetect
RedrawWindow
SetProcessDefaultLayout
ScreenToClient
GetWindowRect
AddClipboardFormatListener
ole32
OleQueryCreateFromData
kernel32
GetCPInfo
CreateFileW
HeapSize
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
VirtualProtectEx
FreeConsole
CloseHandle
WaitForSingleObjectEx
GetCurrentThreadId
GetExitCodeThread
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceCounter
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
GetLocaleInfoEx
CompareStringEx
WriteConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
IsValidCodePage
RaiseException
RtlUnwind
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
Sections
.text Size: 271KB - Virtual size: 270KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ