SYMBOLCOMMON_NAMEaka. SYNONYMS
win.avos_locker (Back to overview)

AvosLocker

VTCollection    

AvosLocker is a ransomware-as-a-service (RaaS) gang that first appeared in mid-2021. It has since become notorious for its attacks targeting critical infrastructure in the United States, including the sectors of financial services, critical manufacturing, and government facilities.

In March 2022, the FBI and US Treasury Department issued a warning about the attacks.

References
2022-06-21 ⋅ Cisco Talos ⋅ Chris Neal, Flavio Costa, Guilherme Venere
Avos ransomware group expands with new attack arsenal
AvosLocker Cobalt Strike DarkComet MimiKatz
2022-05-20 ⋅ AdvIntel ⋅ Marley Smith, Vitali Kremez, Yelisey Boguslavskiy
DisCONTInued: The End of Conti’s Brand Marks New Chapter For Cybercrime Landscape
AvosLocker Black Basta BlackByte BlackCat Conti HelloKitty Hive
2022-05-02 ⋅ Trend Micro ⋅ Alvin Nieto, Christoper Ordonez
AvosLocker Ransomware Variant Abuses Driver File to Disable Anti-Virus, Scans for Log4shell
AvosLocker
2022-05-02 ⋅ LIFARS ⋅ Vlad Pasca
A Deep Dive into AvosLocker Ransomware
AvosLocker
2022-04-28 ⋅ Symantec ⋅ Karthikeyan C Kasiviswanathan, Vishal Kamble
Ransomware: How Attackers are Breaching Corporate Networks
AvosLocker Conti Emotet Hive IcedID PhotoLoader QakBot TrickBot
2022-04-18 ⋅ AdvIntel ⋅ Vitali Kremez, Yelisey Boguslavskiy
Enter KaraKurt: Data Extortion Arm of Prolific Ransomware Group
AvosLocker BazarBackdoor BlackByte BlackCat Cobalt Strike HelloKitty Hive Karakurt
2022-04-07 ⋅ Blackberry ⋅ The BlackBerry Research & Intelligence Team
Threat Thursday: AvosLocker Prompts Advisory from FBI and FinCEN
Avoslocker AvosLocker
2022-04-04 ⋅ Trend Micro ⋅ Trend Micro Research
Ransomware Spotlight: AvosLocker
AvosLocker
2022-03-17 ⋅ Sophos ⋅ Tilly Travers
The Ransomware Threat Intelligence Center
ATOMSILO Avaddon AvosLocker BlackKingdom Ransomware BlackMatter Conti Cring DarkSide dearcry Dharma Egregor Entropy Epsilon Red Gandcrab Karma LockBit LockFile Mailto Maze Nefilim RagnarLocker Ragnarok REvil RobinHood Ryuk SamSam Snatch WannaCryptor WastedLocker
2022-03-17 ⋅ IC3 ⋅ FBI, FINCEN, U.S. Department of the Treasury
Indicators of Compromise Associated with AvosLocker Ransomware
Avoslocker AvosLocker
2022-03-16 ⋅ Symantec ⋅ Symantec Threat Hunter Team
The Ransomware Threat Landscape: What to Expect in 2022
AvosLocker BlackCat BlackMatter Conti DarkSide DoppelPaymer Emotet Hive Karma Mespinoza Nemty Squirrelwaffle VegaLocker WastedLocker Yanluowang Zeppelin
2022-03-06 ⋅ Qualys ⋅ Ghanshyam More
AvosLocker Ransomware Behavior Examined on Windows & Linux
Avoslocker AvosLocker
2022-01-17 ⋅ Cybleinc ⋅ Cyble
AvosLocker Ransomware Linux Version Targets VMware ESXi Servers
Avoslocker AvosLocker
2021-12-22 ⋅ Sophos ⋅ Anand Ajjan, Andrew Brandt, Ferenc László Nagy, Fraser Howard, Peter Mackenzie, Sergio Bestulic, Timothy Easton
Avos Locker remotely accesses boxes, even running in Safe Mode
AvosLocker
2021-08-24 ⋅ Palo Alto Networks Unit 42 ⋅ Doel Santos, Ruchna Nigam
Ransomware Groups to Watch: Emerging Threats
HelloKitty AvosLocker HelloKitty Hive LockBit
2021-07-23 ⋅ Malwarebytes ⋅ hasherezade
AvosLocker enters the ransomware scene, asks for partners
AvosLocker
Yara Rules
[TLP:WHITE] win_avos_locker_auto (20260917 | Detects win.avos_locker.)
rule win_avos_locker_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.avos_locker."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avos_locker"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83e010 0f840c000000 8365f0ef 8d4dc0 e9???????? c3 8d4dd8 }
            // n = 7, score = 100
            //   83e010               | and                 eax, 0x10
            //   0f840c000000         | je                  0x12
            //   8365f0ef             | and                 dword ptr [ebp - 0x10], 0xffffffef
            //   8d4dc0               | lea                 ecx, [ebp - 0x40]
            //   e9????????           |                     
            //   c3                   | ret                 
            //   8d4dd8               | lea                 ecx, [ebp - 0x28]

        $sequence_1 = { 8b4d18 85c9 743f 8b4514 3bd9 8b7c2424 8bf1 }
            // n = 7, score = 100
            //   8b4d18               | mov                 ecx, dword ptr [ebp + 0x18]
            //   85c9                 | test                ecx, ecx
            //   743f                 | je                  0x41
            //   8b4514               | mov                 eax, dword ptr [ebp + 0x14]
            //   3bd9                 | cmp                 ebx, ecx
            //   8b7c2424             | mov                 edi, dword ptr [esp + 0x24]
            //   8bf1                 | mov                 esi, ecx

        $sequence_2 = { 33c9 0f118558feffff c78568feffff617b7e37 66c7856cfeffff2851 88856efeffff 8a8558feffff 30840d59feffff }
            // n = 7, score = 100
            //   33c9                 | xor                 ecx, ecx
            //   0f118558feffff       | movups              xmmword ptr [ebp - 0x1a8], xmm0
            //   c78568feffff617b7e37     | mov    dword ptr [ebp - 0x198], 0x377e7b61
            //   66c7856cfeffff2851     | mov    word ptr [ebp - 0x194], 0x5128
            //   88856efeffff         | mov                 byte ptr [ebp - 0x192], al
            //   8a8558feffff         | mov                 al, byte ptr [ebp - 0x1a8]
            //   30840d59feffff       | xor                 byte ptr [ebp + ecx - 0x1a7], al

        $sequence_3 = { 5e 8d0488 8b0428 03c5 5d a3???????? 5b }
            // n = 7, score = 100
            //   5e                   | pop                 esi
            //   8d0488               | lea                 eax, [eax + ecx*4]
            //   8b0428               | mov                 eax, dword ptr [eax + ebp]
            //   03c5                 | add                 eax, ebp
            //   5d                   | pop                 ebp
            //   a3????????           |                     
            //   5b                   | pop                 ebx

        $sequence_4 = { 7317 8a840d6df9ffff 32856cf9ffff 88840d6df9ffff 41 ebde c68587f9ffff00 }
            // n = 7, score = 100
            //   7317                 | jae                 0x19
            //   8a840d6df9ffff       | mov                 al, byte ptr [ebp + ecx - 0x693]
            //   32856cf9ffff         | xor                 al, byte ptr [ebp - 0x694]
            //   88840d6df9ffff       | mov                 byte ptr [ebp + ecx - 0x693], al
            //   41                   | inc                 ecx
            //   ebde                 | jmp                 0xffffffe0
            //   c68587f9ffff00       | mov                 byte ptr [ebp - 0x679], 0

        $sequence_5 = { 72ee 8b75e4 57 52 8d45d4 8bcb 50 }
            // n = 7, score = 100
            //   72ee                 | jb                  0xfffffff0
            //   8b75e4               | mov                 esi, dword ptr [ebp - 0x1c]
            //   57                   | push                edi
            //   52                   | push                edx
            //   8d45d4               | lea                 eax, [ebp - 0x2c]
            //   8bcb                 | mov                 ecx, ebx
            //   50                   | push                eax

        $sequence_6 = { e8???????? c745d400000000 c745e400000000 c745e800000000 0f1000 c745f03f000000 0f1145d4 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   c745d400000000       | mov                 dword ptr [ebp - 0x2c], 0
            //   c745e400000000       | mov                 dword ptr [ebp - 0x1c], 0
            //   c745e800000000       | mov                 dword ptr [ebp - 0x18], 0
            //   0f1000               | movups              xmm0, xmmword ptr [eax]
            //   c745f03f000000       | mov                 dword ptr [ebp - 0x10], 0x3f
            //   0f1145d4             | movups              xmmword ptr [ebp - 0x2c], xmm0

        $sequence_7 = { 6a72 8d8d10fcffff e8???????? 88851afcffff 6a63 8d8d10fcffff e8???????? }
            // n = 7, score = 100
            //   6a72                 | push                0x72
            //   8d8d10fcffff         | lea                 ecx, [ebp - 0x3f0]
            //   e8????????           |                     
            //   88851afcffff         | mov                 byte ptr [ebp - 0x3e6], al
            //   6a63                 | push                0x63
            //   8d8d10fcffff         | lea                 ecx, [ebp - 0x3f0]
            //   e8????????           |                     

        $sequence_8 = { 40 83f80b 7306 8a54240c ebf0 51 8d442411 }
            // n = 7, score = 100
            //   40                   | inc                 eax
            //   83f80b               | cmp                 eax, 0xb
            //   7306                 | jae                 8
            //   8a54240c             | mov                 dl, byte ptr [esp + 0xc]
            //   ebf0                 | jmp                 0xfffffff2
            //   51                   | push                ecx
            //   8d442411             | lea                 eax, [esp + 0x11]

        $sequence_9 = { 6a6f 8d8d04efffff e8???????? 88850fefffff 6a72 8d8d04efffff e8???????? }
            // n = 7, score = 100
            //   6a6f                 | push                0x6f
            //   8d8d04efffff         | lea                 ecx, [ebp - 0x10fc]
            //   e8????????           |                     
            //   88850fefffff         | mov                 byte ptr [ebp - 0x10f1], al
            //   6a72                 | push                0x72
            //   8d8d04efffff         | lea                 ecx, [ebp - 0x10fc]
            //   e8????????           |                     

    condition:
        7 of them and filesize < 1701888
}
Download all Yara Rules