malware family

AvosLocker

unknownentity:malware_familyransomware · 1 source

In March 2022, the FBI and the U.S. Treasury Financial Crimes Enforcement Network released a joint advisory addressing AvosLocker and their activity targeting organizations across several critical infrastructure sectors. The RaaS gang deploys ransomware onto their victim’s networks and systems, then threatens to leak their files on the dark web if they don’t pay up. AvosLocker is both the name of the RaaS gang, as well as the name of the ransomware itself.

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: avoslocker
kind: malware family
status: unknown
aliases: Avos
jurisdictions: —
claims naming it: 4 · 0 attributions · 0 relations · 0 events

Identifiers

attack S1053via mitre-attack
misp-galaxy 73d3d8f8-83cc-4fdc-a645-d03b9a7b5a9bvia misp-galaxy-ransomware
misp-galaxy ba42ab03-9d29-40c3-b3d4-c2045e47dc07via misp-galaxy-ransomware

Relations

computedno relations recorded for this entity

Events

computedno dated events recorded for this entity

Claims naming this entitynewest first · 4 of 4

AvosLockerransomwarepayment
subjecttransactionde1003399d…f57195c6fa
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1MiGyooKN32XiiQ37x6EJwbbfw6mJ7d27G · 19,365 sat · time 2021-09-09 13:19 UTC · url https://ransomwhe.re/#address/1MiGyooKN32XiiQ37x6EJwbbfw6mJ7d27G
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25768btcintel:annotations:25768@v3 sha256:b3a005520a3f4720
confidencetrusted provider · 50
AvosLockerransomwarepayment
subjecttransactionaa8419ac67…876ba0d4f9
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1MiGyooKN32XiiQ37x6EJwbbfw6mJ7d27G · 180,450,000 sat · time 2021-09-09 13:33 UTC · url https://ransomwhe.re/#address/1MiGyooKN32XiiQ37x6EJwbbfw6mJ7d27G
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25767btcintel:annotations:25767@v3 sha256:f7f12f5163ab23e4
confidencetrusted provider · 50
AvosLockerransomwarepayment
subjecttransaction98cd916056…89c5c43a70
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencepayment 1MiGyooKN32XiiQ37x6EJwbbfw6mJ7d27G · 159,091,479 sat · time 2021-09-09 18:29 UTC · url https://ransomwhe.re/#address/1MiGyooKN32XiiQ37x6EJwbbfw6mJ7d27G
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 3
ann_25766btcintel:annotations:25766@v3 sha256:197a88858479ed2b
confidencetrusted provider · 50
AvosLockerransomwarepayment address
subjectaddress1MiGyooKN32XiiQ37x6EJwbbfw6mJ7d27G
sourceRansomwhereRansomwhere (ransomwhe.re), CC BY 4.0
evidencefamily raw AvosLocker · url https://ransomwhe.re/#address/1MiGyooKN32XiiQ37x6EJwbbfw6mJ7d27G
fetch 2026-10-06 18:49 UTCsha256 182ef70144fde9bfvalid from 2026-09-22version 2
ann_25765btcintel:annotations:25765@v2 sha256:35b9c38096e6746d
confidencetrusted provider · 50

Subjects4 subjects carry a claim naming this entity · a sample

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.