avoslocker | 0424f4756a36c7df2d3da36d4255fb3b85ee0938e84a57c84abe739ef1228e2c

General

Target
2026-03-12_034a086b0589d81bfc31d107768b86e8_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 807KB
Sample260312-c9ep6aew9z
SHA256 0424f4756a36c7df2d3da36d4255fb3b85ee0938e84a57c84abe739ef1228e2c
MD5 034a086b0589d81bfc31d107768b86e8
SHA1 1b969dd790055b0ce73bd2bb99da533b5b29205c
SHA512 4afa8f207f2826f1a3b0ace513e082f9f9d8d3bcb77da3aa257c2c09614408d45bffd91e2080edf2e970b02a8f800ae9ee4008ad33d0e43799a9e5d2dc6f0b18
SSDEEP 12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBksYAl:u4s+oT+NXBLi0rjFXvyHBYbhCZa8
TLSH
T181058D317587E473C46100B19C7DB9AA9129BD350B355AC7A3D93B2DAABC2C10F32E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-03-12_034a086b0589d81bfc31d107768b86e8_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat
- Size 807KB
- SHA256 0424f4756a36c7df2d3da36d4255fb3b85ee0938e84a57c84abe739ef1228e2c
- MD5 034a086b0589d81bfc31d107768b86e8
- SHA1 1b969dd790055b0ce73bd2bb99da533b5b29205c
- SHA512 4afa8f207f2826f1a3b0ace513e082f9f9d8d3bcb77da3aa257c2c09614408d45bffd91e2080edf2e970b02a8f800ae9ee4008ad33d0e43799a9e5d2dc6f0b18
- SSDEEP 12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBksYAl:u4s+oT+NXBLi0rjFXvyHBYbhCZa8
- TLSH
  T181058D317587E473C46100B19C7DB9AA9129BD350B355AC7A3D93B2DAABC2C10F32E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution avoslocker impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Avoslocker family
  avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (9298) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2