Threat Thursday: AvosLocker Prompts Advisory from FBI and FinCEN

AvosLocker and the affiliate group behind it appear to be ramping up their operations targeting critical infrastructure in the U.S., sparking a recent advisory from the FBI and FinCEN. The bulletin includes the malware’s Indicators of Compromise (IoCs) and a warning that the criminal group seems to be focusing on financial services, critical manufacturing, government facilities and other critical industries.

First seen late 2021, this aggressive ransomware is designed to quickly encrypt valuable data on compromised machines. Like most modern ransomware families such as LokiLocker, AvosLocker is sold and distributed as Ransomware-as-a-Service (RaaS), which means that the attack vectors and targets of the malware are open to the needs of the malware operator. This threat is not just Windows® -based. In early 2022, a Linux® -based variant of the malware was found that targets VMware ESXi Virtual Machine (VM) environments.

AvosLocker has adopted a common feature of modern ransomware in its choice of double extortion. This ploy involves attackers compromising the victim’s environment prior to the execution of the ransom attack and exfiltrating valuable data. Like the previously discussed malware family Karma, data pilfered by AvosLocker is often hosted on an Onion page found via the Tor browser. This tactic is meant to put additional pressure on affected organizations to pay the ransom demand, as attackers will publish sensitive data online if victims don’t pay in time.

Operating System

Risk & Impact

Technical Analysis

Infection Vector

Since AvosLocker ransomware is sold as RaaS, attackers can use different mechanisms, artifacts, and tooling on victims’ machines. Based on our initial findings, attacks appear to be premeditated, and threat groups perform reconnaissance prior to the deployment of the ransomware. According to the FBI Traffic Light Protocol (TLP) report, tools like Cobalt Strike, Advanced IP Scanner, and AnyDesk are common in AvosLocker attacks.

It is likely that the threat actor maintains a foothold and has already achieved persistence on a victim organization’s network to exfiltrate data. The malware operators will execute the ransomware once initial steps of their attacks are conducted, then clear their tracks after their objective is achieved. 

File Analysis

AvosLocker ransomware can affect systems based on Windows (written in C++) and Linux (compiled in GCC 4.4.7), with specific versions of the malware developed to target each operating system, as seen in Figure 1.

Neither the Windows nor the Linux version of the malware attempts to hide the fact that it is malicious. They are not signed with falsified or stolen digital certificate data, and they do not try to fool a victim into thinking the file is safe, to get them to inadvertently execute the malware.

This lack of deception is likely because the malware is being executed by attackers that are already on the compromised victim’s network, or through remote code-execution via persistence mechanisms already deployed on the compromised network.

The malware has various flags that will determine its execution flow, including enabling further features of the malware that can be customized by the malware operator. Depending on the aim of the threat actor executing the ransomware, various flags can be set, enabling further features of the malware. These can be seen in the table and Figure 2 below.

Windows-Based Parameters

When the Windows version of the malware is executed using its default settings, a dialog box will be generated that indicates this build of the malware (as of early 2022) is called “Sonic,” as shown in Figure 3.

By default, the malware will execute using 200 threads concurrently to achieve its encryption, which makes it faster than other ransomware families we have analyzed. 

Preventing Unintentional Corruption

This malware has a variety of methods in place to prevent itself from damaging a victim’s files or machine beyond repair. Some of these behaviors are quite common, though one in particular is unexpected.

Ransomware commonly avoids encrypting certain directories and files to prevent the entire system from becoming unrecoverable. Causing this kind of damage would defeat the incentive for victims to pay the ransom, so the ransomware will only be destructive to specific file-extensions, omitting key files and directories.

The unique twist in this tactic is that there is a console dialog box created by the running instance of AvosLocker that notifies which files it will skip or avoid encrypting, as shown in Figure 4. This only appears to be enabled or disabled by using the flag/variable “-s” or “--unsafe.”

The malware will also create a mutex named “Cheic0WaZie6zeiy.” It uses this marker to check if it’s already running, to prevent the malware from reinfecting a machine. 

Encryption and Ransom

The malware will quickly scan for attached drives, looking for files to encrypt. Once scanning is complete, the threat will rapidly iterate through the device, appending filenames on Windows machines with either “.avos” or “.avos2” (for the 2022 version), and “AvosLinux” on Linux machines.

On Windows, the ransom note: “GET_YOUR_FILES_BACK.txt,” shown in Figure 5, is added to all directories that have been affected by the ransomware.

The malware uses RSA encryption, with a hardcoded RSA public key that is stored within the malware itself. Once a file is encrypted, AvosLocker appends a snippet of Base64 data to each file it has encoded, as shown in Figure 6. This is likely done to prevent double-encryption or re-infection, and to identify files by the decryption methodology the threat group deploys, so that it can properly decrypt files if a ransom is successfully paid.

If the ransomware was executed twice on a comprised system, the twice-encrypted data is likely to become un-recoverable and/or corrupt. As with omitting critical files from encryption, preventing files from being corrupted is done to avoid defeating the purpose of demanding payment for recovering a victim’s data.

Linux AvosLocker

To maximize the malware’s damage potential, in early 2022, the threat actors behind AvosLocker developed a Linux edition of the ransomware aimed at targeting and encrypting VMware ESXi. The file details of the Linux version are shown in Figure 7.

Compiled in GCC 4.4.7 like its Windows-based counterpart, the malware does little to hide itself. It’s also likely to be deployed only after the initial goals of the threat group have been achieved.

Also like the Windows version, the Linux version of the malware has various flags that it can accept on execution to carry out specific tasks. This is shown in the table and Figure 8 below.

Linux-Based Parameters

Omitted Files

The malware will target all files in a Linux environment except for files with the “.avoslinux” or “.avos2” file-extension (which are encrypted by the malware), or the “README_FOR_RESTORE” ransom note files.

AvosLocker has a variable called “esxi,” which can be used to further limit the file types that are encrypted, to only target VMware-related files.

• .vmdk
• .vmem
  
• .vsmp
  
• .vswp
  
• .vmsm
  
• .log
  

Leak Site

AvosLocker’s Tor Onion website allows malware operators to open a dialogue with affected organizations, and is used to host its “leak site,” which is shown in Figure 10. Upon encryption, an ID is generated in the ransom note that instructs the victim to download the Tor Browser and contact the threat actors directly to organize ransom payment.

Conclusion

AvosLocker ransomware is extremely fast and impactful, designed to encrypt a system in a matter of moments. Though AvosLocker shares a lot in common with most advanced ransomware families currently in the wild, its focus on large-scale targets and varying deployment tactics makes this threat extremely dangerous.

Stopping “just” ransomware is difficult enough. But because of the way this threat spreads, even if the attempt fails, it’s likely that a breach in the organization’s network has already occurred. Documents and valuable data have probably already been stolen before the ransomware stage of the attack even begins.

Constant activity on the ransomware’s leak site acts as a warning to other companies, and a direct threat to those who fall victim to the malware. While this double-extortion ploy is potentially more lucrative for threat actors, it is also far riskier, as there are several steps that must be accomplished without being detected for them to achieve their nefarious goals.

AvosLocker is constantly evolving, with new updates being periodically released. We will update this post with new information as it becomes available.

YARA Rule

The following YARA rule was authored by the BlackBerry Research & Intelligence Team to catch the threat described in this document:

Indicators of Compromise (IoCs)

BlackBerry Assistance

If you’re battling this malware or a similar threat, you’ve come to the right place, regardless of your existing BlackBerry relationship.

The BlackBerry Incident Response Team is made up of world-class consultants dedicated to handling response and containment services for a wide range of incidents, including ransomware and Advanced Persistent Threat (APT) cases.

We have a global consulting team standing by to assist you, providing around-the-clock support where required, as well as local assistance. Please contact us here: https://www.blackberry.com/us/en/forms/cylance/handraiser/emergency-incident-response-containment