AvosLocker is the ransomware payload of the Avos RaaS group, active from July 2021 to approximately May 2023, targeting education, manufacturing, and healthcare sectors on Windows, Linux, and VMware ESXi environments, with the US accounting for ~72% of victims.
Genera un perfil del actor con IA (defensivo) cuando lo pidas.
Este grupo no tiene TTPs curadas. Puedes generar un mapeo MITRE ESTIMADO por IA (no confirmado) a partir de su descripción/notas, solo cuando lo pidas.
Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.
rule ransomware_win_avoslocker {
meta:
id = "fc5c2483-48cb-4282-b6cb-ac728b948607"
version = "1.0"
description = "Detect AvosLocker ransomware (2021-07)"
author = "Sekoia.io"
creation_date = "2021-08-03"
classification = "TLP:CLEAR"
hash6 = "f810deb1ba171cea5b595c6d3f816127fb182833f7a08a98de93226d4f6a336f"
hash7 = "c0a42741eef72991d9d0ee8b6c0531fc19151457a8b59bdcf7b6373d1fe56e02"
hash8 = "84d94c032543e8797a514323b0b8fd8bd69b4183f17351628b13d1464093af2d"
strings:
$s1 = "cryptopp850\\rijndael_simd.cpp" ascii
$s2 = "cryptopp850\\sha_simd.cpp" ascii
$s3 = "cryptopp850\\gf2n_simd.cpp" ascii
$s4 = "cryptopp850\\sse_simd.cpp" ascii
condition:
all of them
and uint16(0)==0x5A4D
and filesize > 900KB
and filesize < 950KB
}Attention! Your files have been encrypted. We highly suggest not shutting down your computer in case encryption process is not finished, as your files may get corrupted. In order to decrypt your files, you must pay for the decryption key & application. You may do so by visiting us at [redactado] This is an onion address that you may access using Tor Browser which you may download at [redactado] Details such as pricing, how long before the price increases and such will be available to you once you enter your ID presented to you below in this note in our website. Contact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly. The corporations whom don't pay or fail to respond in a swift manner can be found in our blog, accessible at [redactado] Your ID: [snip]
Documents include Legal, Financials, passports, licenses Truckslogic Optimiza la logística de tu empresa. Queremos hacer tu vida y la de tu empresa más fácil, ofrecemos un servicio personalizado, flexible y con la experiencia de más de 15 años en el mercado. Colombia Carrera 12A #78-35, Piso 2, Bogotá. República Dominicana Calle Euclides Morillo 58, Diamond Mall - Local 81. Santo Domingo Guatemala Calzada Roosevelt 51-25, Ciudad de Guatemala. CP: 01057 Panamá International Business Park Edificio 3825. local 107, planta baja Panamá Pacífico
| Organización | País | Sector | Grupo | Descubierta |
|---|---|---|---|---|
| Truckslogic | GT | Transportation/Logistics | — | 26 dic 2022 |
| DLS Motors | PY | Transportation/Logistics | — | 26 dic 2022 |
Las direcciones de los sitios de filtración (.onion) se conocen pero no se publican ni se enlazan. Solo se muestran metadatos públicos. ética
We downloaded 50GB of internal files from DLS Motors. -- Just 83 years ago, the company Sobera S.A. entered the Paraguayan market, bringing new business opportunities, new projects, new sources of employment and contributing to the sustained economic growth of our country.