Overview

overview

10

Static

static

3

de6152b2b3...43.exe

windows7-x64

10

de6152b2b3...43.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-03-2024 15:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    de6152b2b3a181509c5d71a332a75043.exe

  • Size

    402KB

  • MD5

    de6152b2b3a181509c5d71a332a75043

  • SHA1

    d62c0ad2ec132065c5807c0fe7a4cabcba34cf29

  • SHA256

    01792043e07a0db52664c5878b253531b293754dc6fd6a8426899c1a66ddd61f

  • SHA512

    99df08f8c0d966c1ca866cc414939ee9ff23a044496497edd5c64fb83a7011718183272f9001dec97111a8e8387218632c7ef6a9f00644e01363540002f5b0d4

  • SSDEEP

    12288:L5rxhWsTDzB6BybYxl+xX4VpMDEvqXHRAS0uayw4H5qsNI4j:L5rxhW6PB6BybYxlWX/DEv4eZw

Score
10/10
avoslockerransomware

Malware Config

Extracted

Path

C:\MSOCache\GET_YOUR_FILES_BACK.txt

Family

avoslocker

Ransom Note
Attention! Your files have been encrypted using AES-256. We highly suggest not shutting down your computer in case encryption process is not finished, as your files may get corrupted. In order to decrypt your files, you must pay for the decryption key & application. You may do so by visiting us at http://avos2fuj6olp6x36.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Hurry up, as the price may increase in the following days. If you fail to respond in a swift manner, we will leak your files in our press release/blog website accessible at http://avos53nnmi4u6amh.onion/ Your ID: a897b099bf811da5f3a69ceedd351c4f9afac28b8d72f4544d4d6a521209ad24
URLs

http://avos2fuj6olp6x36.onion

http://avos53nnmi4u6amh.onion/

Signatures

  • Avoslocker Ransomware

    Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

    ransomwareavoslocker
  • Renames multiple (70) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de6152b2b3a181509c5d71a332a75043.exe
    "C:\Users\Admin\AppData\Local\Temp\de6152b2b3a181509c5d71a332a75043.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\GET_YOUR_FILES_BACK.txt
    Filesize

    913B

    MD5

    0237b63f764204e00d7242cc4d908271

    SHA1

    9d88e59463e2a963bea95d6a2cc5383e922f2f27

    SHA256

    7bee0aff7241590f5bd35727a1a544a492b7533f1acba685611dd269078d1857

    SHA512

    0daec31046c2704b30760f7aecc944f9591cdf22511e5e9276f3dbc376cc60b04853c3e25abca2e754aeaaaac49c264c7d89d418c832c8275fb5484d51a99b3e

    Download Submit