Win32/Filecoder.AvosLocker.A (file analysis)

The Win32/Filecoder.AvosLocker.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Filecoder.AvosLocker.A virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
Enumerates running processes
Authenticode signature is invalid
Writes a potential ransom message to disk

How to determine Win32/Filecoder.AvosLocker.A?


File Info:
name: 95B6F0BEC4EED44376CE.mlw
path: /opt/CAPEv2/storage/binaries/d12824961d2018d4c83e384cf73f610bb75062e6b69bc36d49dedadafd175f9b
crc32: 62294B5C
md5: 95b6f0bec4eed44376ce61ac591a7a56
sha1: 9ed07ae198fde5552008d4e6cf1a35f92f529ba4
sha256: d12824961d2018d4c83e384cf73f610bb75062e6b69bc36d49dedadafd175f9b
sha512: da481d8ee941f70b9d9e0dfcc10c8c30d80250adf0a7cea2f48a534ab633b43133db2fa0a393795204ba3491c8e685cb3476bd20d121011e1755bdd95dc6696a
ssdeep: 12288:Oom+nsxyCEosHw2kY66vezYu+OeO+OeNhBBhhBBpINoI8jgkqFLtWnhJs149HIqP:FmRxwHw2kY66v7G8j2AnfCtq
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T190058E727587E073C46100F25C2DA5ABA52CBC750B3569D7A3D93B2DAABC2C10F32E56
sha3_384: f347451612bb74990d78e903d71764315cef58ebe9e1bec11a165824b953bec938cb744c611f97d863d49c3a8169c0fd
ep_bytes: e8b0040000e974feffffcccccccccccc
timestamp: 2021-11-02 20:49:19

Version Info:
0: [No Data]

Win32/Filecoder.AvosLocker.A also known as:

Bkav	W32.AIDetect.malware2
DrWeb	Trojan.Encoder.34465
MicroWorld-eScan	Gen:Variant.Ransom.AVOSLocker.17
FireEye	Generic.mg.95b6f0bec4eed443
ALYac	Gen:Variant.Ransom.AVOSLocker.17
Cylance	Unsafe
VIPRE	Gen:Variant.Ransom.AVOSLocker.17
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0058241e1 )
K7GW	Trojan ( 0058241e1 )
Cybereason	malicious.ec4eed
BitDefenderTheta	Gen:NN.ZexaF.34786.YuW@aCXaREli
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Filecoder.AvosLocker.A
Paloalto	generic.ml
ClamAV	Win.Ransomware.Deepscan-9938939-0
Kaspersky	HEUR:Trojan-Ransom.Win32.AvosLocker.gen
BitDefender	Gen:Variant.Ransom.AVOSLocker.17
Avast	Win32:RansomX-gen [Ransom]
Tencent	Malware.Win32.Gencirc.11dc9da3
Ad-Aware	Gen:Variant.Ransom.AVOSLocker.17
TACHYON	Ransom/W32.AvosLocker.824832
Emsisoft	Gen:Variant.Ransom.AVOSLocker.17 (B)
Zillya	Trojan.AvosLocker.Win32.1
TrendMicro	Ransom.Win32.AVOSLOCKER.SMYXBLNT
McAfee-GW-Edition	GenericRXRJ-ZL!95B6F0BEC4EE
Sophos	Mal/Generic-S
Ikarus	Trojan-Ransom.FileCrypter
GData	Gen:Variant.Ransom.AVOSLocker.17
Jiangmin	Trojan.AvosLocker.a
Avira	TR/FileCoder.ikyyn
Antiy-AVL	Trojan/Generic.ASMalwS.1D6F
Microsoft	Ransom:Win32/AvosLocker.MBK!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Ransomware/Win.AvosLocker.R449576
McAfee	GenericRXRJ-ZL!95B6F0BEC4EE
MAX	malware (ai score=88)
VBA32	BScope.TrojanRansom.Cryptor
Malwarebytes	Malware.AI.3336335761
APEX	Malicious
Rising	Trojan.Generic@AI.88 (RDML:8NrrHj7aArgO6d0zSUeP7Q)
Yandex	Trojan.Filecoder!JxfVQE7KJKg
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Filecoder_AvosLocker.A!tr.ransom
AVG	Win32:RansomX-gen [Ransom]
Panda	Trj/GdSda.A
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Win32/Filecoder.AvosLocker.A?

Win32/Filecoder.AvosLocker.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X