Overview

overview

10

Static

static

3

43b7a60c0e...56.exe

windows10-2004-x64

10

Resubmissions

15/06/2026, 16:38

260615-t5m96scz8z

15/06/2026, 16:38

260615-t5e9kacz8s

15/06/2026, 16:36

260615-t39emacz6z10

09/06/2024, 18:26

240609-w3g2gsdd8v10

19/07/2021, 19:34

210719-85ryxybqhe10

Sharing

Copy URL Twitter E-mail

General

  • Target
    43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856
  • Size 402KB
  • Sample260615-t39emacz6z
  • SHA256 43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
avoslockerdiscoveryransomware

Malware Config

Extracted

Path

  • C:\Recovery\GET_YOUR_FILES_BACK.txt

  • avoslocker

Ransom Note
  • Attention! Your files have been encrypted using AES-256. We highly suggest not shutting down your computer in case encryption process is not finished, as your files may get corrupted. In order to decrypt your files, you must pay for the decryption key & application. You may do so by visiting us at http://avos2fuj6olp6x36.onion. This is an onion address that you may access using Tor Browser which you may download at https://www.torproject.org/download/ Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Hurry up, as the price may increase in the following days. If you fail to respond in a swift manner, we will leak your files in our press release/blog website accessible at http://avos53nnmi4u6amh.onion/ Message from agent: We have exfiltrated confidential documents, passports scans, social security numbers and financial documents. All data will be leaked if you do not cooperate! Your ID: 168e11dcf2c8e477a570a445a82dec00ed1ae418a6722075b2986ccfd661f2d6
URLs

  • http://avos2fuj6olp6x36.onion

  • http://avos53nnmi4u6amh.onion/

Targets

    • Target
      43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856
    • Size 402KB
    • SHA256 43b7a60c0ef8b4af001f45a0c57410b7374b1d75a6811e0dfc86e4d60f503856
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryavoslockerransomware

    • Family: Avoslocker Ransomware

      Avoslocker is a relatively new ransomware, that was observed in late June and early July, 2021.

      ransomwareavoslocker

    • Renames multiple (55) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks