Resubmissions
30/11/2025, 12:12
251130-pc6htsvpft1030/11/2025, 12:00
251130-n6lvvahl711009/11/2025, 19:58
251109-ypxk5asqhm1006/11/2025, 21:43
251106-1kxrfatrhp1003/11/2025, 21:39
251103-1hxzesak9z1004/10/2025, 20:19
251004-y355es1qy91009/04/2025, 13:37
250409-qwzeas1rx931/03/2025, 05:19
250331-fz687stwdz31/03/2025, 05:18
250331-fzse2swn1331/03/2025, 05:18
250331-fzmvkawnz8Analysis
- max time kernel
328s - max time network
331s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
30/11/2025, 12:12
General
- Target RansomwareSamples/Avos_18_07_2021_403KB.exe
- Size 402KB
- Sample251130-pc6htsvpft
- SHA256 01792043e07a0db52664c5878b253531b293754dc6fd6a8426899c1a66ddd61f
Malware Config
Extracted
-
C:\c599bf4aca4a3f8e50d49e699299\GET_YOUR_FILES_BACK.txt
-
avoslocker
- Attention! Your files have been encrypted using AES-256. We highly suggest not shutting down your computer in case encryption process is not finished, as your files may get corrupted. In order to decrypt your files, you must pay for the decryption key & application. You may do so by visiting us at http://avos2fuj6olp6x36.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Hurry up, as the price may increase in the following days. If you fail to respond in a swift manner, we will leak your files in our press release/blog website accessible at http://avos53nnmi4u6amh.onion/ Your ID: a897b099bf811da5f3a69ceedd351c4f9afac28b8d72f4544d4d6a521209ad24
-
http://avos2fuj6olp6x36.onion
-
http://avos53nnmi4u6amh.onion/
Signatures
- Avoslocker Ransomware
Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
- Avoslocker family
- Renames multiple (85) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 14 IoCs
- Suspicious use of SendNotifyMessage 13 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Avos_18_07_2021_403KB.exe"C:\Users\Admin\AppData\Local\Temp\RansomwareSamples\Avos_18_07_2021_403KB.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\GET_YOUR_FILES_BACK.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CompleteFormat.3gp2"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GET_YOUR_FILES_BACK.txt
memory/5688-518-0x00007FFEB7FFD000-0x00007FFEB7FFF000-memory.dmp
memory/5688-519-0x00007FFEB7D50000-0x00007FFEB8006000-memory.dmp
memory/5688-530-0x00007FF6D1C30000-0x00007FF6D1D28000-memory.dmp
memory/5688-531-0x00007FFEBF320000-0x00007FFEBF354000-memory.dmp
memory/5688-539-0x00007FFEB83D0000-0x00007FFEB83E1000-memory.dmp
memory/5688-541-0x00007FFEB7D00000-0x00007FFEB7D41000-memory.dmp
memory/5688-540-0x00007FFEB2420000-0x00007FFEB262B000-memory.dmp
memory/5688-538-0x00007FFEB83F0000-0x00007FFEB840D000-memory.dmp
memory/5688-537-0x00007FFEB8410000-0x00007FFEB8421000-memory.dmp
memory/5688-536-0x00007FFEBB0D0000-0x00007FFEBB0E7000-memory.dmp
memory/5688-535-0x00007FFEBD620000-0x00007FFEBD631000-memory.dmp
memory/5688-534-0x00007FFEBEF50000-0x00007FFEBEF67000-memory.dmp
memory/5688-533-0x00007FFEBF300000-0x00007FFEBF318000-memory.dmp
memory/5688-532-0x00007FFEB7D50000-0x00007FFEB8006000-memory.dmp
memory/5688-550-0x00007FFEB7740000-0x00007FFEB7758000-memory.dmp
memory/5688-551-0x00007FFEB7710000-0x00007FFEB7740000-memory.dmp
memory/5688-558-0x0000015F9A3E0000-0x0000015F9A4EE000-memory.dmp
memory/5688-557-0x0000015F9A180000-0x0000015F9A3D3000-memory.dmp
memory/5688-556-0x00007FFEB2060000-0x00007FFEB20BC000-memory.dmp
memory/5688-555-0x00007FFEB70E0000-0x00007FFEB7137000-memory.dmp
memory/5688-554-0x00007FFEB7620000-0x00007FFEB7631000-memory.dmp
memory/5688-553-0x00007FFEB6F00000-0x00007FFEB6F7C000-memory.dmp
memory/5688-552-0x00007FFEB6F80000-0x00007FFEB6FE7000-memory.dmp
memory/5688-549-0x00007FFEB7760000-0x00007FFEB7771000-memory.dmp
memory/5688-548-0x00007FFEB7780000-0x00007FFEB779B000-memory.dmp
memory/5688-547-0x00007FFEB77A0000-0x00007FFEB77B1000-memory.dmp
memory/5688-546-0x00007FFEB7C70000-0x00007FFEB7C81000-memory.dmp
memory/5688-545-0x00007FFEB7C90000-0x00007FFEB7CA1000-memory.dmp
memory/5688-544-0x00007FFEB7CB0000-0x00007FFEB7CC8000-memory.dmp
memory/5688-543-0x00007FFEB7CD0000-0x00007FFEB7CF1000-memory.dmp
memory/5688-542-0x00007FFEA4370000-0x00007FFEA5420000-memory.dmp
memory/5688-559-0x0000015F9A580000-0x0000015F9BDEF000-memory.dmp
memory/5688-602-0x00007FFEA4370000-0x00007FFEA5420000-memory.dmp