avoslocker | ce1bedcb3d70f5de3460d55208cd3a0d7b00d797f91a532a9d582345daf9d89a

General

Target
2026-03-14_38f0b27b3fe0417f8d96c811a788188d_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 807KB
Sample260314-b6ds1sgv3p
SHA256 ce1bedcb3d70f5de3460d55208cd3a0d7b00d797f91a532a9d582345daf9d89a
MD5 38f0b27b3fe0417f8d96c811a788188d
SHA1 b21fa0a491c79c2008f1a570e2a932a36eb7336b
SHA512 af4f6947c5653494783d61aedccc15be4833ae4621bb0c96fdf2e049ca20a8bbc823741393b6eabb4d29ac9d48af63f81ebc4c29dd39b12f507b54b634a3825a
SSDEEP 12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBSsYAH:u4s+oT+NXBLi0rjFXvyHBCbbCZa8
TLSH
T1D2058D317587E473C46100B19C7DB9AA9129BD350B355AC7A3D93B2DAABC2C10F32E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\GET_YOUR_FILES_BACK.txt

Ransom Note

AvosLocker Attention! Your systems have been encrypted, and your confidential documents were downloaded. In order to restore your data, you must pay for the decryption key & application. You may do so by visiting us at http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Contact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly. The corporations whom don't pay or fail to respond in a swift manner have their data leaked in our blog, accessible at http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion Additional notes from attackers responsible: we have all databases . inculding all customers personal data etc.. if you dont pay ransom on time we willl leak all the data. Your ID: 2a810d51034e56d360f67b7025e8a2d1e723d990ca3fe2c37f2a0a475b10d020

URLs

http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion
http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion

Targets

- Target
  2026-03-14_38f0b27b3fe0417f8d96c811a788188d_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat
- Size 807KB
- SHA256 ce1bedcb3d70f5de3460d55208cd3a0d7b00d797f91a532a9d582345daf9d89a
- MD5 38f0b27b3fe0417f8d96c811a788188d
- SHA1 b21fa0a491c79c2008f1a570e2a932a36eb7336b
- SHA512 af4f6947c5653494783d61aedccc15be4833ae4621bb0c96fdf2e049ca20a8bbc823741393b6eabb4d29ac9d48af63f81ebc4c29dd39b12f507b54b634a3825a
- SSDEEP 12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBSsYAH:u4s+oT+NXBLi0rjFXvyHBCbbCZa8
- TLSH
  T1D2058D317587E473C46100B19C7DB9AA9129BD350B355AC7A3D93B2DAABC2C10F32E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution avoslocker impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Avoslocker family
  avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (9302) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2