Overview

overview

10

Static

static

3

2026-03-12...at.exe

windows10-2004-x64

10

2026-03-12...at.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    57s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/03/2026, 03:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-03-12_930396ca316e4d07121ca04601aafc0e_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat.exe
  • Size 402KB
  • Sample260312-djsprsey71
  • SHA256 6ef3cb57ec42150e8af5727bdd20e1d20eb141090e40b5d9347c4db6634b5b5a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryavoslockerransomware

Malware Config

Extracted

Path

  • F:\$RECYCLE.BIN\S-1-5-21-643422742-1162610606-620613169-1000\GET_YOUR_FILES_BACK.txt

  • avoslocker

Ransom Note
  • Attention! Your files have been encrypted using AES-256. We highly suggest not shutting down your computer in case encryption process is not finished, as your files may get corrupted. In order to decrypt your files, you must pay for the decryption key & application. You may do so by visiting us at http://avos2fuj6olp6x36.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Hurry up, as the price may increase in the following days. If you fail to respond in a swift manner, we will leak your files in our press release/blog website accessible at http://avos53nnmi4u6amh.onion/ Your ID: a897b099bf811da5f3a69ceedd351c4f9afac28b8d72f4544d4d6a521209ad24
URLs

  • http://avos2fuj6olp6x36.onion

  • http://avos53nnmi4u6amh.onion/

Signatures

  • Avoslocker Ransomware

    Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

    ransomwareavoslocker
  • Avoslocker family
    avoslocker
  • Renames multiple (63) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-03-12_930396ca316e4d07121ca04601aafc0e_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-03-12_930396ca316e4d07121ca04601aafc0e_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_medusalocker_njrat.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:4896

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        GET_YOUR_FILES_BACK.txt
        • Path F:\$RECYCLE.BIN\S-1-5-21-643422742-1162610606-620613169-1000\GET_YOUR_FILES_BACK.txt
        • Size 913B
        • SHA256 7bee0aff7241590f5bd35727a1a544a492b7533f1acba685611dd269078d1857
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4896-472-0x0000000000EE0000-0x0000000000F3F000-memory.dmp
        Download