AvosLocker (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.avos_locker (Back to overview)

AvosLocker

VTCollection

AvosLocker is a ransomware-as-a-service (RaaS) gang that first appeared in mid-2021. It has since become notorious for its attacks targeting critical infrastructure in the United States, including the sectors of financial services, critical manufacturing, and government facilities.

In March 2022, the FBI and US Treasury Department issued a warning about the attacks.

References

2022-06-21 ⋅ Cisco Talos ⋅ Chris Neal, Flavio Costa, Guilherme Venere
Avos ransomware group expands with new attack arsenal
AvosLocker Cobalt Strike DarkComet MimiKatz

2022-05-20 ⋅ AdvIntel ⋅ Marley Smith, Vitali Kremez, Yelisey Boguslavskiy
DisCONTInued: The End of Conti’s Brand Marks New Chapter For Cybercrime Landscape
AvosLocker Black Basta BlackByte BlackCat Conti HelloKitty Hive

2022-05-02 ⋅ Trend Micro ⋅ Alvin Nieto, Christoper Ordonez
AvosLocker Ransomware Variant Abuses Driver File to Disable Anti-Virus, Scans for Log4shell
AvosLocker

2022-05-02 ⋅ LIFARS ⋅ Vlad Pasca
A Deep Dive into AvosLocker Ransomware
AvosLocker

2022-04-28 ⋅ Symantec ⋅ Karthikeyan C Kasiviswanathan, Vishal Kamble
Ransomware: How Attackers are Breaching Corporate Networks
AvosLocker Conti Emotet Hive IcedID PhotoLoader QakBot TrickBot

2022-04-18 ⋅ AdvIntel ⋅ Vitali Kremez, Yelisey Boguslavskiy
Enter KaraKurt: Data Extortion Arm of Prolific Ransomware Group
AvosLocker BazarBackdoor BlackByte BlackCat Cobalt Strike HelloKitty Hive Karakurt

2022-04-07 ⋅ Blackberry ⋅ The BlackBerry Research & Intelligence Team
Threat Thursday: AvosLocker Prompts Advisory from FBI and FinCEN
Avoslocker AvosLocker

2022-04-04 ⋅ Trend Micro ⋅ Trend Micro Research
Ransomware Spotlight: AvosLocker
AvosLocker

2022-03-17 ⋅ Sophos ⋅ Tilly Travers
The Ransomware Threat Intelligence Center
ATOMSILO Avaddon AvosLocker BlackKingdom Ransomware BlackMatter Conti Cring DarkSide dearcry Dharma Egregor Entropy Epsilon Red Gandcrab Karma LockBit LockFile Mailto Maze Nefilim RagnarLocker Ragnarok REvil RobinHood Ryuk SamSam Snatch WannaCryptor WastedLocker

2022-03-17 ⋅ IC3 ⋅ FBI, FINCEN, U.S. Department of the Treasury
Indicators of Compromise Associated with AvosLocker Ransomware
Avoslocker AvosLocker

2022-03-16 ⋅ Symantec ⋅ Symantec Threat Hunter Team
The Ransomware Threat Landscape: What to Expect in 2022
AvosLocker BlackCat BlackMatter Conti DarkSide DoppelPaymer Emotet Hive Karma Mespinoza Nemty Squirrelwaffle VegaLocker WastedLocker Yanluowang Zeppelin

2022-03-06 ⋅ Qualys ⋅ Ghanshyam More
AvosLocker Ransomware Behavior Examined on Windows & Linux
Avoslocker AvosLocker

2022-01-17 ⋅ Cybleinc ⋅ Cyble
AvosLocker Ransomware Linux Version Targets VMware ESXi Servers
Avoslocker AvosLocker

2021-12-22 ⋅ Sophos ⋅ Anand Ajjan, Andrew Brandt, Ferenc László Nagy, Fraser Howard, Peter Mackenzie, Sergio Bestulic, Timothy Easton
Avos Locker remotely accesses boxes, even running in Safe Mode
AvosLocker

2021-08-24 ⋅ Palo Alto Networks Unit 42 ⋅ Doel Santos, Ruchna Nigam
Ransomware Groups to Watch: Emerging Threats
HelloKitty AvosLocker HelloKitty Hive LockBit

2021-07-23 ⋅ Malwarebytes ⋅ hasherezade
AvosLocker enters the ransomware scene, asks for partners
AvosLocker

Yara Rules

[TLP:WHITE] win_avos_locker_auto (20260504 | Detects win.avos_locker.)

rule win_avos_locker_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.avos_locker."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avos_locker"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8d8d18ffffff e9???????? 8d8d18ffffff e9???????? 8d8d20feffff e9???????? 8d8d14feffff }
            // n = 7, score = 100
            //   8d8d18ffffff         | lea                 ecx, [ebp - 0xe8]
            //   e9????????           |                     
            //   8d8d18ffffff         | lea                 ecx, [ebp - 0xe8]
            //   e9????????           |                     
            //   8d8d20feffff         | lea                 ecx, [ebp - 0x1e0]
            //   e9????????           |                     
            //   8d8d14feffff         | lea                 ecx, [ebp - 0x1ec]

        $sequence_1 = { 6a6e 8d8df0fbffff e8???????? 8885f8fbffff 6a65 8d8df0fbffff e8???????? }
            // n = 7, score = 100
            //   6a6e                 | push                0x6e
            //   8d8df0fbffff         | lea                 ecx, [ebp - 0x410]
            //   e8????????           |                     
            //   8885f8fbffff         | mov                 byte ptr [ebp - 0x408], al
            //   6a65                 | push                0x65
            //   8d8df0fbffff         | lea                 ecx, [ebp - 0x410]
            //   e8????????           |                     

        $sequence_2 = { 8d41e8 894431dc c706???????? c745fcffffffff 56 c706???????? e8???????? }
            // n = 7, score = 100
            //   8d41e8               | lea                 eax, [ecx - 0x18]
            //   894431dc             | mov                 dword ptr [ecx + esi - 0x24], eax
            //   c706????????         |                     
            //   c745fcffffffff       | mov                 dword ptr [ebp - 4], 0xffffffff
            //   56                   | push                esi
            //   c706????????         |                     
            //   e8????????           |                     

        $sequence_3 = { 8bc8 ff7508 e8???????? e9???????? 0fbe41ff 8d04c510104a00 50 }
            // n = 7, score = 100
            //   8bc8                 | mov                 ecx, eax
            //   ff7508               | push                dword ptr [ebp + 8]
            //   e8????????           |                     
            //   e9????????           |                     
            //   0fbe41ff             | movsx               eax, byte ptr [ecx - 1]
            //   8d04c510104a00       | lea                 eax, [eax*8 + 0x4a1010]
            //   50                   | push                eax

        $sequence_4 = { f00fc14608 7507 8b06 8bce ff5004 6a20 }
            // n = 6, score = 100
            //   f00fc14608           | lock xadd           dword ptr [esi + 8], eax
            //   7507                 | jne                 9
            //   8b06                 | mov                 eax, dword ptr [esi]
            //   8bce                 | mov                 ecx, esi
            //   ff5004               | call                dword ptr [eax + 4]
            //   6a20                 | push                0x20

        $sequence_5 = { e8???????? 0fb600 50 8d8db0fcffff e8???????? 888563fdffff }
            // n = 6, score = 100
            //   e8????????           |                     
            //   0fb600               | movzx               eax, byte ptr [eax]
            //   50                   | push                eax
            //   8d8db0fcffff         | lea                 ecx, [ebp - 0x350]
            //   e8????????           |                     
            //   888563fdffff         | mov                 byte ptr [ebp - 0x29d], al

        $sequence_6 = { c7855cffffff00000000 f30f7e4590 897db0 660f7ec8 660fd68558ffffff 83bd5cffffff10 898548ffffff }
            // n = 7, score = 100
            //   c7855cffffff00000000     | mov    dword ptr [ebp - 0xa4], 0
            //   f30f7e4590           | movq                xmm0, qword ptr [ebp - 0x70]
            //   897db0               | mov                 dword ptr [ebp - 0x50], edi
            //   660f7ec8             | movd                eax, xmm1
            //   660fd68558ffffff     | movq                qword ptr [ebp - 0xa8], xmm0
            //   83bd5cffffff10       | cmp                 dword ptr [ebp - 0xa4], 0x10
            //   898548ffffff         | mov                 dword ptr [ebp - 0xb8], eax

        $sequence_7 = { 0f8706010000 8d1c0e 3bda 7304 8bda eb0c 81fbffffff1f }
            // n = 7, score = 100
            //   0f8706010000         | ja                  0x10c
            //   8d1c0e               | lea                 ebx, [esi + ecx]
            //   3bda                 | cmp                 ebx, edx
            //   7304                 | jae                 6
            //   8bda                 | mov                 ebx, edx
            //   eb0c                 | jmp                 0xe
            //   81fbffffff1f         | cmp                 ebx, 0x1fffffff

        $sequence_8 = { 89842420020000 53 56 57 6800000100 c744241c5a003a00 c74424205c000000 }
            // n = 7, score = 100
            //   89842420020000       | mov                 dword ptr [esp + 0x220], eax
            //   53                   | push                ebx
            //   56                   | push                esi
            //   57                   | push                edi
            //   6800000100           | push                0x10000
            //   c744241c5a003a00     | mov                 dword ptr [esp + 0x1c], 0x3a005a
            //   c74424205c000000     | mov                 dword ptr [esp + 0x20], 0x5c

        $sequence_9 = { 8b530c 8b7b08 8955e8 897dcc 0fb602 35c59d1c81 69c893010001 }
            // n = 7, score = 100
            //   8b530c               | mov                 edx, dword ptr [ebx + 0xc]
            //   8b7b08               | mov                 edi, dword ptr [ebx + 8]
            //   8955e8               | mov                 dword ptr [ebp - 0x18], edx
            //   897dcc               | mov                 dword ptr [ebp - 0x34], edi
            //   0fb602               | movzx               eax, byte ptr [edx]
            //   35c59d1c81           | xor                 eax, 0x811c9dc5
            //   69c893010001         | imul                ecx, eax, 0x1000193

    condition:
        7 of them and filesize < 1701888
}

Download all Yara Rules

AvosLocker Propose Change

References

Yara Rules

AvosLocker