avoslocker | 33e648333f7d85219d6b82e64c44f9ee849e99da8691deddcb34ee694c73c538 | Triage

Resubmissions

07/03/2025, 23:57

250307-3ztz7szlx8 10

07/03/2025, 23:44

250307-3rm7payzay 10

Sharing

General

Target

44000c80effa84d7b149003e07b9c73ebfdb73f21672f6beee69f6a298c226fb
Size

56.0MB
Sample

250307-3ztz7szlx8
MD5

bf362ca5f9b4dfa01b0ca45937f0f8d2
SHA1

0dac7e77257f51ee11e04803874d764e8fa8ae3a
SHA256

33e648333f7d85219d6b82e64c44f9ee849e99da8691deddcb34ee694c73c538
SHA512

4b83fd771113cdfc2c4c4a58546802e8e8d115a546193b74a5eccd73a1420819a4f5c117b1a33cb5c715fad5bb3513b472dfd81af928a9c24290abe5fad39497
SSDEEP

196608:cmKu818v8SYdQmRm8Qnf2ODjMnGydS8GrNs:Gu81olYdQdF3MnG38GrNs

Score

10^/10

avoslocker defense_evasion discovery evasion execution impact pyinstaller ransomware

Malware Config

Targets

- Target
  
  44000c80effa84d7b149003e07b9c73ebfdb73f21672f6beee69f6a298c226fb
- Size
  
  56.0MB
- MD5
  
  bf362ca5f9b4dfa01b0ca45937f0f8d2
- SHA1
  
  0dac7e77257f51ee11e04803874d764e8fa8ae3a
- SHA256
  
  33e648333f7d85219d6b82e64c44f9ee849e99da8691deddcb34ee694c73c538
- SHA512
  
  4b83fd771113cdfc2c4c4a58546802e8e8d115a546193b74a5eccd73a1420819a4f5c117b1a33cb5c715fad5bb3513b472dfd81af928a9c24290abe5fad39497
- SSDEEP
  
  196608:cmKu818v8SYdQmRm8Qnf2ODjMnGydS8GrNs:Gu81olYdQdF3MnG38GrNs
Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Avoslocker family
  avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (8954) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

behavioral2

avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware

behavioral3

avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware

behavioral4

avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware