Trend Micro Research. (2022, April 4). Ransomware Spotlight AvosLocker. Retrieved January 11, 2023.
Not cited by any technique.
None recorded.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1036.008 Masquerade File Type |
MalwareAvosLocker | AvosLocker has been disguised as a .jpg file. |
| T1083 File and Directory Discovery |
MalwareAvosLocker | AvosLocker has searched for files and directories on a compromised network. |
| T1486 Data Encrypted for Impact |
MalwareAvosLocker | AvosLocker has encrypted files and network resources using AES-256 and added an `.avos`, `.avos2`, or `.AvosLinux` extension to filenames. |
| T1529 System Shutdown/Reboot |
MalwareAvosLocker | AvosLocker’s Linux variant has terminated ESXi virtual machines. |
| T1547.001 Registry Run Keys / Startup Folder |
MalwareAvosLocker | AvosLocker has been executed via the `RunOnce` Registry key to run itself on safe mode. |
| T1688 Safe Mode Boot |
MalwareAvosLocker | AvosLocker can restart a compromised machine in safe mode. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
