avoslocker | 9b541fcef44f395d8fe3da9c6f4afb95dc25d33082e58d2e2541c418ee8b8d07 | Triage

Sharing

General

Target

2025-03-23_528d138f078aea724b85f07e4c4a3670_avoslocker_cobalt-strike_luca-stealer
Size

807KB
Sample

250323-d5v21sysc1
MD5

528d138f078aea724b85f07e4c4a3670
SHA1

3428fcec32a3820febe48efb2f65517819f82476
SHA256

9b541fcef44f395d8fe3da9c6f4afb95dc25d33082e58d2e2541c418ee8b8d07
SHA512

cc668f9d59756270fa1f52419dc0c2b39650d559b00e6fec9ffb3871697c039ccc8ba474e89db3ae4587b3d328e282cca6c3bc43d75c8ffafab8ab0143c3a6b4
SSDEEP

12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYAU:u4s+oT+NXBLi0rjFXvyHBlShCZa8

Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware

Malware Config

Targets

- Target
  
  2025-03-23_528d138f078aea724b85f07e4c4a3670_avoslocker_cobalt-strike_luca-stealer
- Size
  
  807KB
- MD5
  
  528d138f078aea724b85f07e4c4a3670
- SHA1
  
  3428fcec32a3820febe48efb2f65517819f82476
- SHA256
  
  9b541fcef44f395d8fe3da9c6f4afb95dc25d33082e58d2e2541c418ee8b8d07
- SHA512
  
  cc668f9d59756270fa1f52419dc0c2b39650d559b00e6fec9ffb3871697c039ccc8ba474e89db3ae4587b3d328e282cca6c3bc43d75c8ffafab8ab0143c3a6b4
- SSDEEP
  
  12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBDsYAU:u4s+oT+NXBLi0rjFXvyHBlShCZa8
Score

10^/10

avoslocker defense_evasion discovery evasion execution impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Avoslocker family
  avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (10407) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware

behavioral2

avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware