Avos Locker remotely accesses boxes, even running in Safe Mode
Tags
cmtmf-attack-pattern: Data Encrypted
country: Portugal
attack-pattern: Credentials - T1589.001 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Safe Mode Boot - T1562.009 Server - T1583.004 Server - T1584.004 Software - T1592.002 Ssh - T1021.004 Tool - T1588.002 Connection Proxy - T1090 Data Encrypted - T1022 Hypervisor - T1062 Powershell - T1086 Remote Access Tools - T1219
Show in Graph
Common Information
Type Value
UUID d0ba3c8a-7df5-4cbd-bac0-3a35a1fa7a17
Fingerprint a62009518825b6c8
Analysis status DONE
Considered CTI value 0
Text language
Published Dec. 22, 2021, 12:30 p.m.
Added to db Sept. 26, 2022, 9:33 a.m.
Last updated Nov. 11, 2024, 8:20 a.m.
Headline Avos Locker remotely accesses boxes, even running in Safe Mode
Title Avos Locker remotely accesses boxes, even running in Safe Mode
Detected Hints/Tags/Attributes 60/3/4
Source URLs
Redirection Url
Details Source https://news.sophos.com/en-us/2021/12/22/avos-locker-remotely-accesses-boxes-even-running-in-safe-mode/
URL Provider
Details Provider Source level domain
Details sophos.com news.sophos.com
Attributes
Details Type #Events CTI Value
Details File 7 
execute.bat
Details File 3 
love.bat
Details File 24 
update.bat
Details File 2 
lock.bat