Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
2025-03-09_dfab91d8937285d668bdeee931f65fe8_avoslocker_luca-stealer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2025-03-09_dfab91d8937285d668bdeee931f65fe8_avoslocker_luca-stealer.exe
Resource
win10v2004-20250217-en
General
-
Target
2025-03-09_dfab91d8937285d668bdeee931f65fe8_avoslocker_luca-stealer
-
Size
1.6MB
-
MD5
dfab91d8937285d668bdeee931f65fe8
-
SHA1
77ab3370ac56fd7f633e628ad3d51b806467656f
-
SHA256
8fff405998f0c149d6797ee27b586342016d74349266472ff0ad31929e28f534
-
SHA512
7e97267d6c4b8cdb195ecc84303eb055c7fbf4b7fcc475d7bd04cedefee6626ebd58dff677a6dfa6c595b08f66679c4e99b1055b697420507a74a9c50f92b95e
-
SSDEEP
24576:RLvpteBrVtMLwQe1Qog2SoWXaJSwXjrLAmPbHMJlso//u:hvpm0MXdh8mPbHMJCoX
Malware Config
Signatures
-
Socelars family
-
Socelars payload 1 IoCs
resource yara_rule sample family_socelars -
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-09_dfab91d8937285d668bdeee931f65fe8_avoslocker_luca-stealer
Files
-
2025-03-09_dfab91d8937285d668bdeee931f65fe8_avoslocker_luca-stealer.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 912KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
UPX1 Size: 606KB - Virtual size: 608KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE