General

  • Target

    f75e92b4cf12745c63966bb50c82e4be_JaffaCakes118

  • Size

    921KB

  • Sample

    240418-f9mbsace68

  • MD5

    f75e92b4cf12745c63966bb50c82e4be

  • SHA1

    e58678781548262b653b34bbf3f55339d53f28cb

  • SHA256

    a1b504b8e34200d8029f6d75491d517e460162cb9df438257ee4ed85f61c18bc

  • SHA512

    2d66d1868e44956c00593d7d19d70b14475571dcd9b5eee9d15ac4fa3d473ce3a05c598c57ea31707b4deaa3469ed046b85f4e9c3f04430e652eda4d6a4f6038

  • SSDEEP

    24576:SnkXEg1ZlhKG+WWZtCpDCE5Ie534SCeTpOl13lHlI:SkXEg1ZlIzZtCpGE5j5oSHOlxRlI

Score
10/10

Malware Config

Extracted

Path

C:\GET_YOUR_FILES_BACK.txt

Ransom Note
AvosLocker Attention! Your systems have been encrypted, and your confidential documents were downloaded. In order to restore your data, you must pay for the decryption key & application. You may do so by visiting us at http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Contact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly. The corporations whom don't pay or fail to respond in a swift manner have their data leaked in our blog, accessible at http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion Additional notes from attackers responsible: Hello, All your data in the company is encrypted and your important company data is backed up. I do not need money, I receive payments from many companies every day and I deal with the encryption of many companies every day. More important than money is time for me. For this reason, I have time to inflate the number and bargain like other friends who do this business. The offer I have made for your company is very reasonable and not a big deal for you. If you do not pay, the data of the company that we have backed up after 7 days will be shared publicly on the internet and you will not be able to recover any of your encrypted data. Your ID: 8c7a9b681dfa1b2b87ea459caddf2adf9413dc76664fb74063fb264116897023
URLs

http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion

http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion

Targets

    • Target

      f75e92b4cf12745c63966bb50c82e4be_JaffaCakes118

    • Size

      921KB

    • MD5

      f75e92b4cf12745c63966bb50c82e4be

    • SHA1

      e58678781548262b653b34bbf3f55339d53f28cb

    • SHA256

      a1b504b8e34200d8029f6d75491d517e460162cb9df438257ee4ed85f61c18bc

    • SHA512

      2d66d1868e44956c00593d7d19d70b14475571dcd9b5eee9d15ac4fa3d473ce3a05c598c57ea31707b4deaa3469ed046b85f4e9c3f04430e652eda4d6a4f6038

    • SSDEEP

      24576:SnkXEg1ZlhKG+WWZtCpDCE5Ie534SCeTpOl13lHlI:SkXEg1ZlIzZtCpGE5j5oSHOlxRlI

    Score
    10/10
    • Avoslocker Ransomware

      Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

    • Renames multiple (160) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks