SYMBOLCOMMON_NAMEaka. SYNONYMS
win.avos_locker (Back to overview)

AvosLocker

VTCollection    

AvosLocker is a ransomware-as-a-service (RaaS) gang that first appeared in mid-2021. It has since become notorious for its attacks targeting critical infrastructure in the United States, including the sectors of financial services, critical manufacturing, and government facilities.

In March 2022, the FBI and US Treasury Department issued a warning about the attacks.

References
2022-06-21 ⋅ Cisco Talos ⋅ Chris Neal, Flavio Costa, Guilherme Venere
Avos ransomware group expands with new attack arsenal
AvosLocker Cobalt Strike DarkComet MimiKatz
2022-05-20 ⋅ AdvIntel ⋅ Marley Smith, Vitali Kremez, Yelisey Boguslavskiy
DisCONTInued: The End of Conti’s Brand Marks New Chapter For Cybercrime Landscape
AvosLocker Black Basta BlackByte BlackCat Conti HelloKitty Hive
2022-05-02 ⋅ Trend Micro ⋅ Alvin Nieto, Christoper Ordonez
AvosLocker Ransomware Variant Abuses Driver File to Disable Anti-Virus, Scans for Log4shell
AvosLocker
2022-05-02 ⋅ LIFARS ⋅ Vlad Pasca
A Deep Dive into AvosLocker Ransomware
AvosLocker
2022-04-28 ⋅ Symantec ⋅ Karthikeyan C Kasiviswanathan, Vishal Kamble
Ransomware: How Attackers are Breaching Corporate Networks
AvosLocker Conti Emotet Hive IcedID PhotoLoader QakBot TrickBot
2022-04-18 ⋅ AdvIntel ⋅ Vitali Kremez, Yelisey Boguslavskiy
Enter KaraKurt: Data Extortion Arm of Prolific Ransomware Group
AvosLocker BazarBackdoor BlackByte BlackCat Cobalt Strike HelloKitty Hive Karakurt
2022-04-07 ⋅ Blackberry ⋅ The BlackBerry Research & Intelligence Team
Threat Thursday: AvosLocker Prompts Advisory from FBI and FinCEN
Avoslocker AvosLocker
2022-04-04 ⋅ Trend Micro ⋅ Trend Micro Research
Ransomware Spotlight: AvosLocker
AvosLocker
2022-03-17 ⋅ Sophos ⋅ Tilly Travers
The Ransomware Threat Intelligence Center
ATOMSILO Avaddon AvosLocker BlackKingdom Ransomware BlackMatter Conti Cring DarkSide dearcry Dharma Egregor Entropy Epsilon Red Gandcrab Karma LockBit LockFile Mailto Maze Nefilim RagnarLocker Ragnarok REvil RobinHood Ryuk SamSam Snatch WannaCryptor WastedLocker
2022-03-17 ⋅ IC3 ⋅ FBI, FINCEN, U.S. Department of the Treasury
Indicators of Compromise Associated with AvosLocker Ransomware
Avoslocker AvosLocker
2022-03-16 ⋅ Symantec ⋅ Symantec Threat Hunter Team
The Ransomware Threat Landscape: What to Expect in 2022
AvosLocker BlackCat BlackMatter Conti DarkSide DoppelPaymer Emotet Hive Karma Mespinoza Nemty Squirrelwaffle VegaLocker WastedLocker Yanluowang Zeppelin
2022-03-06 ⋅ Qualys ⋅ Ghanshyam More
AvosLocker Ransomware Behavior Examined on Windows & Linux
Avoslocker AvosLocker
2022-01-17 ⋅ Cybleinc ⋅ Cyble
AvosLocker Ransomware Linux Version Targets VMware ESXi Servers
Avoslocker AvosLocker
2021-12-22 ⋅ Sophos ⋅ Anand Ajjan, Andrew Brandt, Ferenc László Nagy, Fraser Howard, Peter Mackenzie, Sergio Bestulic, Timothy Easton
Avos Locker remotely accesses boxes, even running in Safe Mode
AvosLocker
2021-08-24 ⋅ Palo Alto Networks Unit 42 ⋅ Doel Santos, Ruchna Nigam
Ransomware Groups to Watch: Emerging Threats
HelloKitty AvosLocker HelloKitty Hive LockBit
2021-07-23 ⋅ Malwarebytes ⋅ hasherezade
AvosLocker enters the ransomware scene, asks for partners
AvosLocker
Yara Rules
[TLP:WHITE] win_avos_locker_auto (20230808 | Detects win.avos_locker.)
rule win_avos_locker_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.avos_locker."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avos_locker"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8d85a8f9ffff 50 8d85fcf5ffff 50 8d8514f6ffff 50 83ec18 }
            // n = 7, score = 100
            //   8d85a8f9ffff         | lea                 eax, [ebp - 0x658]
            //   50                   | push                eax
            //   8d85fcf5ffff         | lea                 eax, [ebp - 0xa04]
            //   50                   | push                eax
            //   8d8514f6ffff         | lea                 eax, [ebp - 0x9ec]
            //   50                   | push                eax
            //   83ec18               | sub                 esp, 0x18

        $sequence_1 = { 8b4024 ffd0 c645fc0a c78598f9ffff00000000 c7859cf9ffff00000000 8b08 898d98f9ffff }
            // n = 7, score = 100
            //   8b4024               | mov                 eax, dword ptr [eax + 0x24]
            //   ffd0                 | call                eax
            //   c645fc0a             | mov                 byte ptr [ebp - 4], 0xa
            //   c78598f9ffff00000000     | mov    dword ptr [ebp - 0x668], 0
            //   c7859cf9ffff00000000     | mov    dword ptr [ebp - 0x664], 0
            //   8b08                 | mov                 ecx, dword ptr [eax]
            //   898d98f9ffff         | mov                 dword ptr [ebp - 0x668], ecx

        $sequence_2 = { 59 3b4580 7359 807d8600 8a8848ef4900 8b857cffffff 8808 }
            // n = 7, score = 100
            //   59                   | pop                 ecx
            //   3b4580               | cmp                 eax, dword ptr [ebp - 0x80]
            //   7359                 | jae                 0x5b
            //   807d8600             | cmp                 byte ptr [ebp - 0x7a], 0
            //   8a8848ef4900         | mov                 cl, byte ptr [eax + 0x49ef48]
            //   8b857cffffff         | mov                 eax, dword ptr [ebp - 0x84]
            //   8808                 | mov                 byte ptr [eax], cl

        $sequence_3 = { 8d8d05efffff e8???????? 8a8d23f0ffff 8808 46 ebbd 6a22 }
            // n = 7, score = 100
            //   8d8d05efffff         | lea                 ecx, [ebp - 0x10fb]
            //   e8????????           |                     
            //   8a8d23f0ffff         | mov                 cl, byte ptr [ebp - 0xfdd]
            //   8808                 | mov                 byte ptr [eax], cl
            //   46                   | inc                 esi
            //   ebbd                 | jmp                 0xffffffbf
            //   6a22                 | push                0x22

        $sequence_4 = { 53 50 e8???????? 83c408 c745fcffffffff 57 8b45d8 }
            // n = 7, score = 100
            //   53                   | push                ebx
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   c745fcffffffff       | mov                 dword ptr [ebp - 4], 0xffffffff
            //   57                   | push                edi
            //   8b45d8               | mov                 eax, dword ptr [ebp - 0x28]

        $sequence_5 = { 8bd3 3ac1 7501 46 42 8a02 84c0 }
            // n = 7, score = 100
            //   8bd3                 | mov                 edx, ebx
            //   3ac1                 | cmp                 al, cl
            //   7501                 | jne                 3
            //   46                   | inc                 esi
            //   42                   | inc                 edx
            //   8a02                 | mov                 al, byte ptr [edx]
            //   84c0                 | test                al, al

        $sequence_6 = { c745e800000000 660fd645e4 837de810 8945d4 8b75cc 0f43d0 8b45d0 }
            // n = 7, score = 100
            //   c745e800000000       | mov                 dword ptr [ebp - 0x18], 0
            //   660fd645e4           | movq                qword ptr [ebp - 0x1c], xmm0
            //   837de810             | cmp                 dword ptr [ebp - 0x18], 0x10
            //   8945d4               | mov                 dword ptr [ebp - 0x2c], eax
            //   8b75cc               | mov                 esi, dword ptr [ebp - 0x34]
            //   0f43d0               | cmovae              edx, eax
            //   8b45d0               | mov                 eax, dword ptr [ebp - 0x30]

        $sequence_7 = { 33c5 50 8d45f4 64a300000000 8b4d0c 8b4508 81f900100000 }
            // n = 7, score = 100
            //   33c5                 | xor                 eax, ebp
            //   50                   | push                eax
            //   8d45f4               | lea                 eax, [ebp - 0xc]
            //   64a300000000         | mov                 dword ptr fs:[0], eax
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   81f900100000         | cmp                 ecx, 0x1000

        $sequence_8 = { 8a42ff 84c0 75eb 81fe59ee4ef8 740b 8b7118 85ff }
            // n = 7, score = 100
            //   8a42ff               | mov                 al, byte ptr [edx - 1]
            //   84c0                 | test                al, al
            //   75eb                 | jne                 0xffffffed
            //   81fe59ee4ef8         | cmp                 esi, 0xf84eee59
            //   740b                 | je                  0xd
            //   8b7118               | mov                 esi, dword ptr [ecx + 0x18]
            //   85ff                 | test                edi, edi

        $sequence_9 = { 89958cecffff c645fc35 8bca 8d7102 668b01 83c102 6685c0 }
            // n = 7, score = 100
            //   89958cecffff         | mov                 dword ptr [ebp - 0x1374], edx
            //   c645fc35             | mov                 byte ptr [ebp - 4], 0x35
            //   8bca                 | mov                 ecx, edx
            //   8d7102               | lea                 esi, [ecx + 2]
            //   668b01               | mov                 ax, word ptr [ecx]
            //   83c102               | add                 ecx, 2
            //   6685c0               | test                ax, ax

    condition:
        7 of them and filesize < 1701888
}
Download all Yara Rules