Overview

overview

10

Static

static

3

2026-03-12...at.exe

windows10-2004-x64

10

2026-03-12...at.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-03-12_2b52ee448ce2ddb8c1f4d437b1a8c566_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat
  • Size 807KB
  • Sample260312-ddc25aex7z
  • SHA256 b36f9cdb882c85da3ca1c1c2a74d67d785000e3d3ca6486bac991742492fac4f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
avoslockerdefense_evasiondiscoveryevasionexecutionimpactransomware

Malware Config

Extracted

Path

  • C:\GET_YOUR_FILES_BACK.txt

Ransom Note
  • AvosLocker Attention! Your systems have been encrypted, and your confidential documents were downloaded. In order to restore your data, you must pay for the decryption key & application. You may do so by visiting us at http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Contact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly. The corporations whom don't pay or fail to respond in a swift manner have their data leaked in our blog, accessible at http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion Additional notes from attackers responsible: Hello, All your data in the company is encrypted and your important company data is backed up. I do not need money, I receive payments from many companies every day and I deal with the encryption of many companies every day. More important than money is time for me. For this reason, I have time to inflate the number and bargain like other friends who do this business. The offer I have made for your company is very reasonable and not a big deal for you. If you do not pay, the data of the company that we have backed up after 7 days will be shared publicly on the internet and you will not be able to recover any of your encrypted data. Your ID: 5f3fadb45185c98fe594898e162a409f88bcee4e916439d4b02b76ca111933a6
URLs

  • http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion

  • http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion

Targets

    • Target
      2026-03-12_2b52ee448ce2ddb8c1f4d437b1a8c566_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat
    • Size 807KB
    • SHA256 b36f9cdb882c85da3ca1c1c2a74d67d785000e3d3ca6486bac991742492fac4f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryevasionexecutionavoslockerimpactransomware

    • Avoslocker Ransomware

      Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

      ransomwareavoslocker

    • Avoslocker family

      avoslocker

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (9269) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks