General

  • Target

    sex.exe

  • Size

    1.1MB

  • Sample

    241228-1ywrasspfy

  • MD5

    adafab2dac5b7c82b724ee21ef9b9074

  • SHA1

    79705ff60099779427009651fdb9a86e305dff20

  • SHA256

    b4589e3b06efe598a5c57d2a93ef9101d91a7be465a7d5aecb2e68b8ed1d0ae7

  • SHA512

    ec030ba61181ec09a974a1dd41ba5a1b713f157c43dcd2cae44dd78c5fd401afaceddfafb7c88e123d476fc09f3550696b3367083285a58fba5e7ae3116ccb48

  • SSDEEP

    24576:lImw98okVgela0as5CqLVO7XJCjkD3N0HRA:7L5ljasaU

Malware Config

Targets

    • Target

      sex.exe

    • Size

      1.1MB

    • MD5

      adafab2dac5b7c82b724ee21ef9b9074

    • SHA1

      79705ff60099779427009651fdb9a86e305dff20

    • SHA256

      b4589e3b06efe598a5c57d2a93ef9101d91a7be465a7d5aecb2e68b8ed1d0ae7

    • SHA512

      ec030ba61181ec09a974a1dd41ba5a1b713f157c43dcd2cae44dd78c5fd401afaceddfafb7c88e123d476fc09f3550696b3367083285a58fba5e7ae3116ccb48

    • SSDEEP

      24576:lImw98okVgela0as5CqLVO7XJCjkD3N0HRA:7L5ljasaU

    • Avoslocker Ransomware

      Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

    • Avoslocker family

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Modifies boot configuration data using bcdedit

    • Renames multiple (10381) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks