avoslocker | 33e648333f7d85219d6b82e64c44f9ee849e99da8691deddcb34ee694c73c538 | Triage

Submit
Reports

Overview

overview

Static

static

3

44000c80ef...fb.exe

windows10-ltsc 2021-x64

Resubmissions

07/03/2025, 23:57 UTC

250307-3ztz7szlx8 10

07/03/2025, 23:44 UTC

250307-3rm7payzay 10

Sharing

General

Target

44000c80effa84d7b149003e07b9c73ebfdb73f21672f6beee69f6a298c226fb
Size

56.0MB
Sample

250307-3rm7payzay
MD5

bf362ca5f9b4dfa01b0ca45937f0f8d2
SHA1

0dac7e77257f51ee11e04803874d764e8fa8ae3a
SHA256

33e648333f7d85219d6b82e64c44f9ee849e99da8691deddcb34ee694c73c538
SHA512

4b83fd771113cdfc2c4c4a58546802e8e8d115a546193b74a5eccd73a1420819a4f5c117b1a33cb5c715fad5bb3513b472dfd81af928a9c24290abe5fad39497
SSDEEP

196608:cmKu818v8SYdQmRm8Qnf2ODjMnGydS8GrNs:Gu81olYdQdF3MnG38GrNs

Score

10^/10

avoslocker defense_evasion discovery evasion execution impact pyinstaller ransomware

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

44000c80effa84d7b149003e07b9c73ebfdb73f21672f6beee69f6a298c226fb.exe

Resource

win10ltsc2021-20250217-en

avoslocker defense_evasion discovery evasion execution impact ransomware

windows10-ltsc 2021-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  44000c80effa84d7b149003e07b9c73ebfdb73f21672f6beee69f6a298c226fb
- Size
  
  56.0MB
- MD5
  
  bf362ca5f9b4dfa01b0ca45937f0f8d2
- SHA1
  
  0dac7e77257f51ee11e04803874d764e8fa8ae3a
- SHA256
  
  33e648333f7d85219d6b82e64c44f9ee849e99da8691deddcb34ee694c73c538
- SHA512
  
  4b83fd771113cdfc2c4c4a58546802e8e8d115a546193b74a5eccd73a1420819a4f5c117b1a33cb5c715fad5bb3513b472dfd81af928a9c24290abe5fad39497
- SSDEEP
  
  196608:cmKu818v8SYdQmRm8Qnf2ODjMnGydS8GrNs:Gu81olYdQdF3MnG38GrNs
Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Avoslocker family
  avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (7662) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.