avoslocker | f2fab3c8562f852d00847aad5ebde069084758be998255b55c0b61b9b3be7c5c | Triage

Submit
Reports

Overview

overview

Static

static

3

f2fab3c856...5c.exe

windows7-x64

f2fab3c856...5c.exe

windows10-2004-x64

Sharing

General

Target

f2fab3c8562f852d00847aad5ebde069084758be998255b55c0b61b9b3be7c5c.exe
Size

1.1MB
Sample

241231-wzr3aaspct
MD5

414577c56ed5184ea260a89fb0d6a878
SHA1

b2d8465417fab504a02f0407af9526d0cf3c8ebd
SHA256

f2fab3c8562f852d00847aad5ebde069084758be998255b55c0b61b9b3be7c5c
SHA512

6a8d0089934dfe27d4ff9cb15b4455ce408c297a490d330067d733b9b0708e1ded9e73a86c0c8efd41b734e9e709e21957b4506608f9b295d132fec1c13e39f3
SSDEEP

24576:aImw98okVgela0as5CqLVO7XJCjkD3N0HRAn:EL5ljasaUW

Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

f2fab3c8562f852d00847aad5ebde069084758be998255b55c0b61b9b3be7c5c.exe

Resource

win7-20240708-en

avoslocker defense_evasion discovery evasion execution impact ransomware

windows7-x64

18 signatures

120 seconds

Behavioral task

behavioral2

Sample

f2fab3c8562f852d00847aad5ebde069084758be998255b55c0b61b9b3be7c5c.exe

Resource

win10v2004-20241007-en

avoslocker defense_evasion discovery evasion execution impact ransomware

windows10-2004-x64

19 signatures

120 seconds

Malware Config

Targets

- Target
  
  f2fab3c8562f852d00847aad5ebde069084758be998255b55c0b61b9b3be7c5c.exe
- Size
  
  1.1MB
- MD5
  
  414577c56ed5184ea260a89fb0d6a878
- SHA1
  
  b2d8465417fab504a02f0407af9526d0cf3c8ebd
- SHA256
  
  f2fab3c8562f852d00847aad5ebde069084758be998255b55c0b61b9b3be7c5c
- SHA512
  
  6a8d0089934dfe27d4ff9cb15b4455ce408c297a490d330067d733b9b0708e1ded9e73a86c0c8efd41b734e9e709e21957b4506608f9b295d132fec1c13e39f3
- SSDEEP
  
  24576:aImw98okVgela0as5CqLVO7XJCjkD3N0HRAn:EL5ljasaUW
Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Avoslocker family
  avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (10412) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware

behavioral2

avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware

© 2018-2025

Terms | Privacy