avoslocker | b39a8b39bc4f868524157b6f5d5304ae3cf5df9ba35934a29a8e29eb908c1a3e

General

Target
2026-03-16_fb3c7de1bf6ed4428e16ce0cc2431819_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat
Size 807KB
Sample260316-cgqa7aax9s
SHA256 b39a8b39bc4f868524157b6f5d5304ae3cf5df9ba35934a29a8e29eb908c1a3e
MD5 fb3c7de1bf6ed4428e16ce0cc2431819
SHA1 a26b1d3167628c64dfa4f49b6b4a8f7658b487cd
SHA512 2be7d3860d52080d0cac1a4419ffa8f1096ce7a8486d4ba8e82ccdf45083e66e9519ba564ebb3bea894620c3693912252a75e296f04cfad18915dcd980e5201d
SSDEEP 12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHB8sYAl:u4s+oT+NXBLi0rjFXvyHBwbhCZa8
TLSH
T189058D317587E473C46100B19D7DB9AA9129BD310B355AC7A3D93B2DAABC2C10F32E5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-03-16_fb3c7de1bf6ed4428e16ce0cc2431819_amadey_avoslocker_cobalt-strike_elex_luca-stealer_lynx_njrat
- Size 807KB
- SHA256 b39a8b39bc4f868524157b6f5d5304ae3cf5df9ba35934a29a8e29eb908c1a3e
- MD5 fb3c7de1bf6ed4428e16ce0cc2431819
- SHA1 a26b1d3167628c64dfa4f49b6b4a8f7658b487cd
- SHA512 2be7d3860d52080d0cac1a4419ffa8f1096ce7a8486d4ba8e82ccdf45083e66e9519ba564ebb3bea894620c3693912252a75e296f04cfad18915dcd980e5201d
- SSDEEP 12288:0Z4s3rg9u/2/oT+NXtHLlP/O+OeO+OeNhBBhhBBAtHg9rjI+LXJ0ivlzkHB8sYAl:u4s+oT+NXBLi0rjFXvyHBwbhCZa8
- TLSH
  T189058D317587E473C46100B19D7DB9AA9129BD310B355AC7A3D93B2DAABC2C10F32E5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution avoslocker impact ransomware
- Avoslocker Ransomware
  Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.
  ransomware avoslocker
- Avoslocker family
  avoslocker
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (9283) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2