avoslocker | e2eff267e9a29f6bbd3d8c26f1813aeb6745cf879fad89c8ef46175427d069f0

General

Target

BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.7z
Size

260KB
Sample

240724-vlv2caxdnn
MD5

30dd519541017f677e0a6e6ce73a0e72
SHA1

45c0f2e82ef4203713841602bc1171dc041aab1b
SHA256

e2eff267e9a29f6bbd3d8c26f1813aeb6745cf879fad89c8ef46175427d069f0
SHA512

77c7f2683b7c16fdedf9b8bc05383fe50c3f8ff75180ac8a99165c48c238d276e0724595bf04266ed750c2e0f44ece47e620729273cc44ade8c5bc1b2250aeee
SSDEEP

6144:IxPH9+x9UV8Peqge8z+dYqYoX136lkgJG4H9Gfsj:IK9UVueDe/yoEl7JGaGfsj

Score

10^/10

Malware Config

Targets

- Target
  
  BFF12A83B1FC2E0AD0000AD9B68ABC8EADA559BB1094CAAF5B9F52887DF23705.exe
- Size
  
  807KB
- MD5
  
  19944159dfa94a1b75effd85e6b906dc
- SHA1
  
  250acf87366f4c0cf91679a0e93dfc79954f0f10
- SHA256
  
  bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705
- SHA512
  
  c791840f59c2fc906c197c43e0e1717b9504cf46177a3688ecbd4937cdbf95349d68cc1e63649b85f02df4e6990c4df4756dd8267b062ea5271dd61fc3e508b0
- SSDEEP
  
  12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYA7:u4s+oT+NXBLi0rjFXvyHBlbnCZa8
Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware trojan
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (8331) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1