2025-03-24_bdff1ff953a801a72d5cd4ab422c081e_amadey_avoslocker_cobalt-strike_luca-stealer_wapomi

Sharing

Copy URL

Twitter E-mail

General

Target

2025-03-24_bdff1ff953a801a72d5cd4ab422c081e_amadey_avoslocker_cobalt-strike_luca-stealer_wapomi
Size

873KB
MD5

bdff1ff953a801a72d5cd4ab422c081e
SHA1

f69de22882aee0435a08f57b28599a560b46b541
SHA256

e9a883ad4de2499bc81a03175eab12c15a54bcfb1261700457cb0ced04541c50
SHA512

428c08d567df21d6ede624b23e139328d364ae7afe9663b23c04929ffb58a1afb359f23c393283430ed531d55a52e9b94d21ec34da722a96ee68cc306536bef2
SSDEEP

12288:c/ej/3Tb0l06t4XOQWSGAOgNRPHCEZnWVCvRn1XZA5kO+6uIGQnSNTTAtUoiL0oV:Tj/jbeLVBsR/CAHn6fuZlTctvEi8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-03-24_bdff1ff953a801a72d5cd4ab422c081e_amadey_avoslocker_cobalt-strike_luca-stealer_wapomi

Files

2025-03-24_bdff1ff953a801a72d5cd4ab422c081e_amadey_avoslocker_cobalt-strike_luca-stealer_wapomi
.exe windows:6 windows x86 arch:x86

67f64e072a02d044478a09c1fff34482

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

X:\Projects\ProvinceX_Client\Bin\Multi Theft Auto.pdb

Imports

kernel32

ReadFile
SetFileAttributesA
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
GetSystemTime
GetLocalTime
GetModuleFileNameW
GetLongPathNameW
GlobalAlloc
GetFileAttributesA
GlobalLock
LocalFree
FormatMessageW
VerifyVersionInfoW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindNextFileW
FindFirstFileW
FindClose
GetCurrentDirectoryW
VerSetConditionMask
K32GetModuleInformation
DecodePointer
HeapSize
GetProcessHeap
GetFullPathNameW
LoadLibraryA
GetFileAttributesExW
MoveFileW
CopyFileW
SetDllDirectoryW
LoadLibraryW
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCPInfo
GetOEMCP
GetACP
GetModuleFileNameA
FreeLibrary
GetCurrentThread
GetCurrentProcess
SetErrorMode
GetLastError
SetFileAttributesW
IsValidCodePage
FindFirstFileExW
RemoveDirectoryW
GetFileAttributesW
GetDiskFreeSpaceExW
DeleteFileW
CreateFileW
CreateDirectoryW
SetCurrentDirectoryW
ExitProcess
Sleep
GlobalUnlock
FlushFileBuffers
SetEndOfFile
SetStdHandle
HeapReAlloc
GetTimeZoneInformation
SetFilePointerEx
OutputDebugStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
WriteFile
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
SetEnvironmentVariableW
WriteConsoleW
GetCommandLineA
GetFileType
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
GetVersion
InitializeCriticalSectionEx
SleepEx
GetSystemDirectoryA
GetTickCount
SetLastError
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
VerifyVersionInfoA
CreateFileA
GetFileSizeEx
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
LoadLibraryExA
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
EncodePointer
TlsAlloc

user32

CloseClipboard
OpenClipboard
EmptyClipboard
SetClipboardData
MessageBoxW
MessageBoxA

gdi32

AddFontResourceExW
RemoveFontResourceExW

advapi32

CryptDestroyHash
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegCloseKey
RegCreateKeyExW
RegFlushKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
CryptHashData

shell32

ShellExecuteExW
SHFileOperationW
SHGetFolderPathW
ShellExecuteA
ShellExecuteW
SHGetFolderPathA

crypt32

CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertCloseStore

normaliz

IdnToAscii

winmm

timeGetTime

ws2_32

WSAWaitForMultipleEvents
WSAResetEvent
WSAGetLastError
WSACleanup
WSACreateEvent
WSACloseEvent
send
closesocket
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
WSAIoctl
WSAStartup
__WSAFDIsSet
select
recv
accept
htonl
listen
getaddrinfo
freeaddrinfo
ioctlsocket
WSAEventSelect
WSAEnumNetworkEvents

Exports

Exports

GetLibMtaVersion
_json_c_strerror
json_c_object_sizeof
json_c_set_serialization_double_format
json_c_shallow_copy_default
json_object_array_add
json_object_array_bsearch
json_object_array_del_idx
json_object_array_get_idx
json_object_array_length
json_object_array_put_idx
json_object_array_shrink
json_object_array_sort
json_object_deep_copy
json_object_double_to_json_string
json_object_equal
json_object_free_userdata
json_object_from_fd
json_object_from_fd_ex
json_object_from_file
json_object_get
json_object_get_array
json_object_get_boolean
json_object_get_double
json_object_get_int
json_object_get_int64
json_object_get_object
json_object_get_string
json_object_get_string_len
json_object_get_type
json_object_get_uint64
json_object_get_userdata
json_object_int_inc
json_object_is_type
json_object_new_array
json_object_new_array_ext
json_object_new_boolean
json_object_new_double
json_object_new_double_s
json_object_new_int
json_object_new_int64
json_object_new_null
json_object_new_object
json_object_new_string
json_object_new_string_len
json_object_new_uint64
json_object_object_add
json_object_object_add_ex
json_object_object_del
json_object_object_get
json_object_object_get_ex
json_object_object_length
json_object_put
json_object_set_boolean
json_object_set_double
json_object_set_int
json_object_set_int64
json_object_set_serializer
json_object_set_string
json_object_set_string_len
json_object_set_uint64
json_object_set_userdata
json_object_to_fd
json_object_to_file
json_object_to_file_ext
json_object_to_json_string
json_object_to_json_string_ext
json_object_to_json_string_length
json_object_userdata_to_json_string
json_parse_double
json_parse_int64
json_parse_uint64
json_tokener_error_desc
json_tokener_free
json_tokener_get_error
json_tokener_get_parse_end
json_tokener_new
json_tokener_new_ex
json_tokener_parse
json_tokener_parse_ex
json_tokener_parse_verbose
json_tokener_reset
json_tokener_set_flags
json_type_to_name
json_util_get_last_err
printbuf_free
printbuf_memappend
printbuf_memset
printbuf_new
printbuf_reset
sprintbuf

Sections

.text
Size: 532KB - Virtual size: 532KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 181KB - Virtual size: 181KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

�ݩ��u�
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

67f64e072a02d044478a09c1fff34482

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

crypt32

normaliz

winmm

ws2_32

Exports

Exports

Sections

.text Size: 532KB - Virtual size: 532KB

.rdata Size: 109KB - Virtual size: 109KB

.data Size: 5KB - Virtual size: 9KB

.detourc Size: 4KB - Virtual size: 4KB

.detourd Size: 512B - Virtual size: 12B

.rsrc Size: 181KB - Virtual size: 181KB

.reloc Size: 22KB - Virtual size: 22KB

�ݩ��u� Size: 16KB - Virtual size: 20KB

.text
Size: 532KB - Virtual size: 532KB

.rdata
Size: 109KB - Virtual size: 109KB

.data
Size: 5KB - Virtual size: 9KB

.detourc
Size: 4KB - Virtual size: 4KB

.detourd
Size: 512B - Virtual size: 12B

.rsrc
Size: 181KB - Virtual size: 181KB

.reloc
Size: 22KB - Virtual size: 22KB

�ݩ��u�
Size: 16KB - Virtual size: 20KB