Overview

overview

10

Static

static

3

1463611b7b...9a.exe

windows7-x64

10

1463611b7b...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1463611b7b46fc5489c8ce287caa8e6faf0eef4c429ad996dee3f64c7c39d29a

  • Size

    602KB

  • Sample

    240531-lgap6seb57

  • MD5

    200098f76839127e1c8a490fc97c5088

  • SHA1

    21c7b77f2ab898c25a6677a99b0f0a0dc27c549d

  • SHA256

    1463611b7b46fc5489c8ce287caa8e6faf0eef4c429ad996dee3f64c7c39d29a

  • SHA512

    f9735134db8d8eb60c7d3cd4bb0d1d17f3066fe11112f3fb71eda76596464fb61515c63dad6b2ddb4cb4c95672c642b344914b668d8cb21b1dd2ef69323f3e38

  • SSDEEP

    12288:rx2s0jR0yePLpyYffiXbXWBq6eOfDTq0UmAlwtK3utfqBB9pcp:rL0jRkckfnBq8fn9UmAx4iH9pcp

Score
10/10
avoslockerransomware

Malware Config

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-268080393-3149932598-1824759070-1000\GET_YOUR_FILES_BACK.txt

Family

avoslocker

Ransom Note
Attention! Your files have been encrypted using AES-256. We highly suggest not shutting down your computer in case encryption process is not finished, as your files may get corrupted. In order to decrypt your files, you must pay for the decryption key & application. You may do so by visiting us at http://avos2fuj6olp6x36.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Hurry up, as the price may increase in the following days. If you fail to respond in a swift manner, we will leak your files in our press release/blog website accessible at http://avos53nnmi4u6amh.onion/ Your ID: c5c5cc75754e1763b14a0651e339cb3ebf64f8a6567aeb1146c5aa7ffa2d19c0
URLs

http://avos2fuj6olp6x36.onion

http://avos53nnmi4u6amh.onion/

Targets

    • Target

      1463611b7b46fc5489c8ce287caa8e6faf0eef4c429ad996dee3f64c7c39d29a

    • Size

      602KB

    • MD5

      200098f76839127e1c8a490fc97c5088

    • SHA1

      21c7b77f2ab898c25a6677a99b0f0a0dc27c549d

    • SHA256

      1463611b7b46fc5489c8ce287caa8e6faf0eef4c429ad996dee3f64c7c39d29a

    • SHA512

      f9735134db8d8eb60c7d3cd4bb0d1d17f3066fe11112f3fb71eda76596464fb61515c63dad6b2ddb4cb4c95672c642b344914b668d8cb21b1dd2ef69323f3e38

    • SSDEEP

      12288:rx2s0jR0yePLpyYffiXbXWBq6eOfDTq0UmAlwtK3utfqBB9pcp:rL0jRkckfnBq8fn9UmAx4iH9pcp

    Score
    10/10
    avoslockerransomware

    • Avoslocker Ransomware

      Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

      ransomwareavoslocker

    • Renames multiple (75) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks