avoslocker | 1676db653523cf585f02707f8f4c337ecb1aaf5afd07416e07e50f14acc88884

General

Target

sex.exe
Size

1.6MB
Sample

241229-agyw8awlhx
MD5

81130843e119926881fd292f78698e43
SHA1

0aacdd67768c851e8f64658bf5e79abb26fc7d94
SHA256

1676db653523cf585f02707f8f4c337ecb1aaf5afd07416e07e50f14acc88884
SHA512

b92f808bd07c824faf1e23061861cce4f5410fe62d19a0f0a68a2ec3a6adb117e783074f87162eaecaaa447e682df406c481ba68167dc9e15612eb2f84f896da
SSDEEP

24576:yImw98okVgela0as5CqLVO7XJCjkD3N0HRAxV0aEhbHdn0TrldepPZ:cL5ljasaUKeaEhDF

Score

10^/10

Malware Config

Targets

- Target
  
  sex.exe
- Size
  
  1.6MB
- MD5
  
  81130843e119926881fd292f78698e43
- SHA1
  
  0aacdd67768c851e8f64658bf5e79abb26fc7d94
- SHA256
  
  1676db653523cf585f02707f8f4c337ecb1aaf5afd07416e07e50f14acc88884
- SHA512
  
  b92f808bd07c824faf1e23061861cce4f5410fe62d19a0f0a68a2ec3a6adb117e783074f87162eaecaaa447e682df406c481ba68167dc9e15612eb2f84f896da
- SSDEEP
  
  24576:yImw98okVgela0as5CqLVO7XJCjkD3N0HRAxV0aEhbHdn0TrldepPZ:cL5ljasaUKeaEhDF
Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware upx
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Avoslocker family
  avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (10447) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2