bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705.exe
Classification: Malicious
bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705.exe is a malicious file sample. Linked to Avoslocker malware.
Detection summary
- 0 antivirus detections (72% detection ratio)
- 0 IDS alerts
- 23 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: AVOSLOCKER (S1053)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Avoslocker | Triage | 2026-02-07 13:12:46 | 2026-02-07 13:12:46 | malicious-activity | S1053 AvosLocker |
| Generic Malware | Hybrid-Analysis | 2023-01-18 08:30:07 | 2024-10-02 12:45:15 | ||
| Ransomware | VM-Ray | 2023-01-24 15:20:32 | 2023-01-24 15:20:32 | ||
| Generic.Malware | MalwareBazaar Abuse.ch | 2023-01-24 14:12:31 | 2023-01-24 14:12:31 | malicious-activity |
Tags
evasive windows-server-utility avoslocker defense_evasion discovery evasion execution impact ransomwareSample information
- Filenames
- bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705.exe, bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705.bin, Roseland.bin
- File type
- PE32 executable (GUI) Intel 80386, for MS Windows
- Size
- 826880 bytes
- MD5
19944159dfa94a1b75effd85e6b906dc- SHA-1
250acf87366f4c0cf91679a0e93dfc79954f0f10- SHA-256
bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705- SHA-512
c791840f59c2fc906c197c43e0e1717b9504cf46177a3688ecbd4937cdbf95349d68cc1e63649b85f02df4e6990c4df4756dd8267b062ea5271dd61fc3e508b0- First indexed
- 2023-01-18 08:05:19
- Last updated
- 2026-06-18 17:50:11
Process list
| Name | Command line |
|---|---|
| bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705.exe | |
| cmd.exe | cmd /c wmic shadowcopy delete /nointeractive |
| cmd.exe | cmd /c vssadmin.exe Delete Shadows /All /Quiet |
| cmd.exe | cmd /c bcdedit /set {default} recoveryenabled No |
| cmd.exe | cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures |
| cmd.exe | cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }" |
| bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705.exe | |
| cmd.exe | cmd /c wmic shadowcopy delete /nointeractive |
| cmd.exe | cmd /c vssadmin.exe Delete Shadows /All /Quiet |
| cmd.exe | cmd /c bcdedit /set {default} recoveryenabled No |
| cmd.exe | cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures |
| cmd.exe | cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }" |
| bff12a83b1fc2e0ad0000ad9b68abc8eada559bb1094caaf5b9f52887df23705.bin.exe | |
| cmd.exe | cmd /c wmic shadowcopy delete /nointeractive |
| WMIC.exe | wmic shadowcopy delete /nointeractive |
| cmd.exe | cmd /c vssadmin.exe Delete Shadows /All /Quiet |
| vssadmin.exe | Delete Shadows /All /Quiet |
| cmd.exe | cmd /c bcdedit /set {default} recoveryenabled No |
| bcdedit.exe | bcdedit /set {default} recoveryenabled No |
| cmd.exe | cmd /c bcdedit /set {default} bootstatuspolicy ignoreallfailures |
| bcdedit.exe | bcdedit /set {default} bootstatuspolicy ignoreallfailures |
| cmd.exe | cmd /c powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }" |
| powershell.exe | powershell -command "Get-EventLog -LogName * | ForEach { Clear-EventLog $_.Log }" |