AvosLocker

This report provides a detailed technical analysis of the AvosLocker ransomware (observed since 2021), describing its configurable command-line options, pre-encryption cleanup (process termination, shadow copy and event log deletion, boot policy changes), multi-threaded AES-CBC encryption with RSA-2048-wrapped keys appended to files, file/ folder exclusion lists, observable IOCs (mutex, extensions .avos/.avos2/.avoslinux, ransom note names), and both Windows and Linux/ESXi behaviors.