2025-03-18_3e063dc0de937df5841cb9c2ff3e4651_avoslocker_cobalt-strike_luca-stealer

Sharing

Copy URL

Twitter E-mail

General

Target

2025-03-18_3e063dc0de937df5841cb9c2ff3e4651_avoslocker_cobalt-strike_luca-stealer
Size

719KB
MD5

3e063dc0de937df5841cb9c2ff3e4651
SHA1

e683bfaeb1a695ff9ef1759cf1944fa3bb3b6948
SHA256

99959c5141f62d4fbb60efdc05260b6e956651963d29c36845f435815062fd98
SHA512

9a0d0c04b95bbf8c73beb398cc72fa8e9dc87e3149e8c2f43b05fca4ef8e4410c1d65ed11e50b01d24719ce6a8996448944ab56601ef65116614a17f2e10d23f
SSDEEP

12288:aKRHZl7Lup6ySk3QYktDNYlg2317DJtY7wdD30qoifK/Ke5ABa4QP9+NrMke03f9:aKslHY7wdD30qnfsKxB+ZKX55WsSuFrl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-03-18_3e063dc0de937df5841cb9c2ff3e4651_avoslocker_cobalt-strike_luca-stealer

Files

2025-03-18_3e063dc0de937df5841cb9c2ff3e4651_avoslocker_cobalt-strike_luca-stealer
.exe windows:6 windows x86 arch:x86

9951b4b852f8bee5d019bc23e6ac6bd6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\ADMINI~1\AppData\Local\Temp\2\74edcda8581f9636c83352ad946821b0\1-locker\Release\1-locker.pdb

Imports

kernel32

GetStdHandle
WriteFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
GetLastError
lstrcatW
CloseHandle
GetWindowsDirectoryW
WideCharToMultiByte
lstrcpyW
AllocConsole
lstrcmpW
MoveFileW
FindFirstFileW
FindNextFileW
lstrlenW
GetLogicalDriveStringsW
GetDriveTypeW
CreateMutexA
GetFileAttributesW
Sleep
CreateThread
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
WriteConsoleW
SetEndOfFile
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcess
GetCommandLineW
FindClose
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetTimeZoneInformation
HeapReAlloc
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetFileType
SetFilePointerEx
GetFileSizeEx
ExitProcess
GetModuleHandleExW
ExitThread
RaiseException
RtlUnwind
LoadLibraryW
UnregisterWaitEx
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
QueryPerformanceCounter
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SetEvent
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList

user32

SystemParametersInfoW
MessageBoxW
wsprintfW
SendMessageTimeoutW

advapi32

RegSetKeyValueW
RegCreateKeyW
RegOpenKeyW
SystemFunction036

shell32

SHChangeNotify
ord680
CommandLineToArgvW
SHGetFolderPathW

ws2_32

inet_pton
select
getaddrinfo
socket
WSAStartup
WSAGetLastError
ioctlsocket
freeaddrinfo
htons
inet_ntop
gethostname
closesocket
connect

netapi32

NetShareEnum
NetApiBufferFree

Sections

.text
Size: 501KB - Virtual size: 501KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9951b4b852f8bee5d019bc23e6ac6bd6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ws2_32

netapi32

Sections

.text Size: 501KB - Virtual size: 501KB

.rdata Size: 135KB - Virtual size: 134KB

.data Size: 58KB - Virtual size: 63KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 23KB - Virtual size: 22KB

.text
Size: 501KB - Virtual size: 501KB

.rdata
Size: 135KB - Virtual size: 134KB

.data
Size: 58KB - Virtual size: 63KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 23KB - Virtual size: 22KB