Overview

overview

10

Static

static

1

794f3d25c4...81.exe

windows7-x64

10

794f3d25c4...81.exe

windows10-2004-x64

10

Resubmissions

18-04-2023 13:23

230418-qm9hxadd6t 10

18-04-2023 05:23

230418-f3g4gshg62 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe

  • Size

    807KB

  • Sample

    230418-f3g4gshg62

  • MD5

    540a177a21044860e104dc2b0512a524

  • SHA1

    20014c52c83ed4cb87a2166ee77937684f1fbeb9

  • SHA256

    794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81

  • SHA512

    234d9b2c9a4b204e4962a9ba02824dfb312347a10bf642642e804b43db91786b0509022c33a671b0dc68cc89ca38841ffd33d38cefa928b8f10af298cc0beac8

  • SSDEEP

    12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYAZ:u4s+oT+NXBLi0rjFXvyHBlbtCZa8

Score
10/10
avoslockerevasionransomware

Malware Config

Targets

    • Target

      794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81.exe

    • Size

      807KB

    • MD5

      540a177a21044860e104dc2b0512a524

    • SHA1

      20014c52c83ed4cb87a2166ee77937684f1fbeb9

    • SHA256

      794f3d25c42d383fad485f9af1d6d7c0508bcfe8ed80a1afea0e0b51bf92bc81

    • SHA512

      234d9b2c9a4b204e4962a9ba02824dfb312347a10bf642642e804b43db91786b0509022c33a671b0dc68cc89ca38841ffd33d38cefa928b8f10af298cc0beac8

    • SSDEEP

      12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYAZ:u4s+oT+NXBLi0rjFXvyHBlbtCZa8

    Score
    10/10
    avoslockerevasionransomware

    • Avoslocker Ransomware

      Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

      ransomwareavoslocker

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks