Analysis
-
max time kernel
15s -
max time network
21s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
12-01-2022 07:04
Static task
static1
Behavioral task
behavioral1
Sample
app/decryptor_avos2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
app/decryptor_avos2.exe
Resource
win10-en-20211208
Behavioral task
behavioral3
Sample
app/linux/decryptor.elf
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
app/linux/decryptor.elf
Resource
win10-en-20211208
General
-
Target
app/decryptor_avos2.exe
-
Size
873KB
-
MD5
841c35b9b28d70519c2bc7dab0bdf1e7
-
SHA1
f07d22a54ade553ce0fce719c8afc333d20794b2
-
SHA256
c7307b1cfd6685c2b3a19a7239a40e8afa5432ffe039bb4b3caca8a70ad1eed6
-
SHA512
81c9644435408b47b88126b663e6725b9d7dddd84e478a2d8844a32d4d6a8ebc8e99ad4a5a6985fc435778da9756e7a917b00ebe422914d850a57176d5e55c4c
Malware Config
Extracted
C:\GET_YOUR_FILES_BACK.txt
avoslocker
http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion
http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion
Signatures
-
Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.