General
-
Target
f75e92b4cf12745c63966bb50c82e4be_JaffaCakes118
-
Size
921KB
-
Sample
240418-f9mbsace68
-
MD5
f75e92b4cf12745c63966bb50c82e4be
-
SHA1
e58678781548262b653b34bbf3f55339d53f28cb
-
SHA256
a1b504b8e34200d8029f6d75491d517e460162cb9df438257ee4ed85f61c18bc
-
SHA512
2d66d1868e44956c00593d7d19d70b14475571dcd9b5eee9d15ac4fa3d473ce3a05c598c57ea31707b4deaa3469ed046b85f4e9c3f04430e652eda4d6a4f6038
-
SSDEEP
24576:SnkXEg1ZlhKG+WWZtCpDCE5Ie534SCeTpOl13lHlI:SkXEg1ZlIzZtCpGE5j5oSHOlxRlI
Static task
static1
Behavioral task
behavioral1
Sample
f75e92b4cf12745c63966bb50c82e4be_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f75e92b4cf12745c63966bb50c82e4be_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
C:\GET_YOUR_FILES_BACK.txt
http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion
http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion
Targets
-
-
Target
f75e92b4cf12745c63966bb50c82e4be_JaffaCakes118
-
Size
921KB
-
MD5
f75e92b4cf12745c63966bb50c82e4be
-
SHA1
e58678781548262b653b34bbf3f55339d53f28cb
-
SHA256
a1b504b8e34200d8029f6d75491d517e460162cb9df438257ee4ed85f61c18bc
-
SHA512
2d66d1868e44956c00593d7d19d70b14475571dcd9b5eee9d15ac4fa3d473ce3a05c598c57ea31707b4deaa3469ed046b85f4e9c3f04430e652eda4d6a4f6038
-
SSDEEP
24576:SnkXEg1ZlhKG+WWZtCpDCE5Ie534SCeTpOl13lHlI:SkXEg1ZlIzZtCpGE5j5oSHOlxRlI
Score10/10-
Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
-
Renames multiple (160) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Sets desktop wallpaper using registry
-