avoslocker | 50d25e639bcb7dcbe66d76a8a2193f4a3e4321d9ebb094e8ebdbf43022dbe34e

General

Target
2026-03-15_da45d6acc359afc1b5de3737d2955310_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 807KB
Sample260315-cby15sat8m
SHA256 50d25e639bcb7dcbe66d76a8a2193f4a3e4321d9ebb094e8ebdbf43022dbe34e
MD5 da45d6acc359afc1b5de3737d2955310
SHA1 0dd1a6ff09c522a049988299f8b717776ab58bd3
SHA512 c348b090349fbfe1c5b18fc1c75e05c61e73f511227e2d6b2f6c615e7c5eff4dc90384b496b1101d481d5fdaa0324c5eaecc9bb3e4005e4741f67ee7a4474a35
SSDEEP 12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHB8sYAP:u4s+oT+NXBLi0rjFXvyHBwbvCZa8
TLSH
T1CA058D317587E473C46100B19C7DB9AA9129BD350B355AC7A3D93B2DAABC2C10F32E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Default\GET_YOUR_FILES_BACK.txt

Ransom Note

AvosLocker Attention! Your systems have been encrypted, and your confidential documents were downloaded. In order to restore your data, you must pay for the decryption key & application. You may do so by visiting us at http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Contact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly. The corporations whom don't pay or fail to respond in a swift manner have their data leaked in our blog, accessible at http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion Additional notes from attackers responsible: WARNING!!! WE EXFILTRATED CONFIDENTIAL DOCUMENTS INCLUDING W-2 FORMS FOR ALL YOUR STAFF WHICH WILL BE LEAKED IF YOU DO NOT PAY!!!!! Your ID: 408e715c94589b0ca8ba5d5f3e630713bb031bb8f83df235604011c6d8ecc8d0

URLs

http://avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion
http://avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion

Targets

- Target
  2026-03-15_da45d6acc359afc1b5de3737d2955310_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat
- Size 807KB
- SHA256 50d25e639bcb7dcbe66d76a8a2193f4a3e4321d9ebb094e8ebdbf43022dbe34e
- MD5 da45d6acc359afc1b5de3737d2955310
- SHA1 0dd1a6ff09c522a049988299f8b717776ab58bd3
- SHA512 c348b090349fbfe1c5b18fc1c75e05c61e73f511227e2d6b2f6c615e7c5eff4dc90384b496b1101d481d5fdaa0324c5eaecc9bb3e4005e4741f67ee7a4474a35
- SSDEEP 12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHB8sYAP:u4s+oT+NXBLi0rjFXvyHBwbvCZa8
- TLSH
  T1CA058D317587E473C46100B19C7DB9AA9129BD350B355AC7A3D93B2DAABC2C10F32E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution avoslocker impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Avoslocker family
  avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (9430) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2