███████╗██╗ ██╗██╗██╗ ███╗ ███╗██╗ ██╗████████╗███████╗██╗ ██╗ ██╔════╝██║ ██║██║██║ ████╗ ████║██║ ██║╚══██╔══╝██╔════╝╚██╗██╔╝ █████╗ ██║ ██║██║██║ ██╔████╔██║██║ ██║ ██║ █████╗ ╚███╔╝ ██╔══╝ ╚██╗ ██╔╝██║██║ ██║╚██╔╝██║██║ ██║ ██║ ██╔══╝ ██╔██╗ ███████╗ ╚████╔╝ ██║███████╗ ██║ ╚═╝ ██║╚██████╔╝ ██║ ███████╗██╔╝ ██╗ ╚══════╝ ╚═══╝ ╚═╝╚══════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝

⚠

AvosLocker

ransomware2 mutex signatures

[BASIC_INFORMATION]

FAMILY_NAME:

AvosLocker

CATEGORY:

RANSOMWARE

DESCRIPTION:

AvosLocker is a Ransomware-as-a-Service (RaaS) affiliate program that has been actively targeting organizations and government institutions since July 2021.

ALIASES:

avoslocker-ransomware

TAGS:

file_encryptionRaaSdouble_extortion

[MUTEX_SIGNATURES](2)

[MUTEX_01]

ievah8eVki3Ho4oo

ANALYST: @adhikara13 DATE: 2025-07-14

REFERENCES:

https://cyble.com/blog/deep-dive-analysis-avoslocker-ransomware/

https://www.threatdown.com/blog/avoslocker-enters-the-ransomware-scene-asks-for-partners/

https://hatching.io/blog/tt-2021-08-12/

[MUTEX_02]

Cheic0WaZie6zeiy

ANALYST: @adhikara13 DATE: 2024-07-16

REFERENCES:

https://www.cyfirma.com/research/avoslocker-ransomware-report/

[QUICK_ACTIONS]

[THREAT_INTELLIGENCE]

ATTRIBUTION:

⚠AvosLocker

FIRST_OBSERVED:

2021

[SIGMA_RULE]

[STATISTICS]

MUTEX_COUNT:2

THREAT_ACTORS:1

ALIASES:1

TAGS:3

CATEGORY:RANSOMWARE

Malware profile loaded successfully