avoslocker | ed1d3b4c7bddbbc5c1c197c62af8cbdd6e7858cf21557d6d54b354def5c5703f

General

Target
2026-03-14_f277f42ae464b436984b8ec0a2f08ddc_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 807KB
Sample260314-dbqkfae18x
SHA256 ed1d3b4c7bddbbc5c1c197c62af8cbdd6e7858cf21557d6d54b354def5c5703f
MD5 f277f42ae464b436984b8ec0a2f08ddc
SHA1 b4dd5cf452b306a41eb0d26061e260fc69610c35
SHA512 26a2000d2c26f2dc3be1e0d829bb6284d31fa408ff8f2a9df66592fb10774571023599ac007fa1e2b4e35185366fdb1da4e4111b7639758d98a4afed031ab8a5
SSDEEP 12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBksYAV:u4s+oT+NXBLi0rjFXvyHBYbdCZa8
TLSH
T1A3058D317587E473C46100B19C7DB9AA9129BD350B355AC7A3D93B2DAABC2C10F32E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-03-14_f277f42ae464b436984b8ec0a2f08ddc_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat
- Size 807KB
- SHA256 ed1d3b4c7bddbbc5c1c197c62af8cbdd6e7858cf21557d6d54b354def5c5703f
- MD5 f277f42ae464b436984b8ec0a2f08ddc
- SHA1 b4dd5cf452b306a41eb0d26061e260fc69610c35
- SHA512 26a2000d2c26f2dc3be1e0d829bb6284d31fa408ff8f2a9df66592fb10774571023599ac007fa1e2b4e35185366fdb1da4e4111b7639758d98a4afed031ab8a5
- SSDEEP 12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHBksYAV:u4s+oT+NXBLi0rjFXvyHBYbdCZa8
- TLSH
  T1A3058D317587E473C46100B19C7DB9AA9129BD350B355AC7A3D93B2DAABC2C10F32E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution avoslocker impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Avoslocker family
  avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (9266) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2