General

  • Target

    taskhost.exe

  • Size

    1.1MB

  • Sample

    200906-hhqmn9hdrn

  • MD5

    255f4b48567937bc0373af60bef975b3

  • SHA1

    93da8a8a67965a9b5cd3f3a9de9f333a541d9dc7

  • SHA256

    d6642e896600cb29365f61dfe28c94c6f075bf90b34cbdf6ff5466756e33eb0d

  • SHA512

    8bee1b0a91eb40d9d613d8e4fc2bff9bdbc1175fa78eda67178dae04aae7700cc219a195eb5cc99ea21290a43f7dfac4c557a58a350a77bebaad2e69d6e8b885

Malware Config

Extracted

Path

C:\Users\Admin\Contacts\JZZ5R_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .BDCDCDDDCc You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTU4LWRGOUw0T0IwMm4wcnhhWEZGVkZqRUE5OU9PVHg2MWxZU3pSVjJkdW9qNVBYdTBFWlE4VmJqZFJQQmVIWlpGK3lsU3NBeDUveGZUQllBazdrSWRSSUJXQ2E3TVBvSFVrRkFqdjRaamhObG9xZzFUMVludlBDeEdtcWVhTkg3dmtaN3dDaUx0N0Y0VlNpd2pnZG1HK04rd0p5OEpob3V0dVQyNDdZd3NuR2tpb0pOaEptVCt1ZVJHSTZPcmNJYnFjbVdIR00veFBRT2ZHV3JrMzZDemRqc3ROMWNnMkl1L21KOCsvVUxObjhvYncybmR6d2hESTVVNUVDWUs2My8xZDdNRmwrMCtOclV3ZjBwSE1udEpwcTA3d0c0YWtpdUhQYm1pS2dCemt3a2JsRnZVaUg4d2tMQ1hqTDc0eGZhOXA3UE4yMU96TWVNOGZUdXJiUVplWFVYdjRQOWVBVEZLY1JBMjZJMzN2cEM4eDdpVTVpUWx1Z1FwUmRvM2xKc1RkMjJyMXBVN3lNaVhQL3JhallpZ2hLYUlOOUVTNWdoRzdKVDBrRnk3emNzajZZa1BCcEFCalBaSUpKb3hreUxjNHQ2Y2FKN3Y2b0ZuYTVJaEt6d3QrdndtTjlzQ2VOMEJNQU1ZRXJ6TUhpT0cyNTR2K0VNdEFOZEdHc2FKRWFTUFRneW9JQ0U2ZTlHRWg2ZFJST2xlbjhQNmxDK3BueVY1QmVTNjNlbVJsYUVMeTFsUEs3YlRsVXQwVGhkVVR6YmNmeHF5OUlmZERBcDZlZWNGY01UY2YyYk1oWW1KL0hoa2tFaDFEam9hRFVOazg0R1ZpdGVhcjJKNjFMaC9JUVFLWVdyN01ienRPNWVHN2JwQVZWd0F2TnR5L2FSM24wUkxCYWdpTVlwM3l5aUdZaFloNFE5SGE3cWk2bit5bG1kcFFZOHl5ZTh0eFVUbWpwTEtJN0VvTExmQmU5YmY0b0JHM0ZoR1hwc3F3d3RRSmN1UDJaSVF0amdzY1VzRDNPYUZzc09wYkZOWmUrR2N1bit2MTVpbDM0RmRZYjFYZTBaM0FLZXJFUm9ST2NRY1ZIYTFIUDJFd2JJRm52dHdUMk5iNVhzTCtCbGFNMjlmaFpFbFNIcjJVRmk4a2JldExiSFpNWFZDWkRhYVBGOHFFczBLN3BPZmlwV3luNGNucXEzUlA3bXNXb1pqbzc3SlNjWG1rQi9mdm1KMGI1eDNrbWl6cDVqdmQzM3M4TEh2dkhkQURJci9kM3BuUUNvZkFiUjVOekQ2Sno4S2tMOWcyNk8vMVJJWC9INlgvRmF4WCtJMHUzem03ajFQRkxLVXhod2hWUkc5ZjRZQUFWblNaaTJIbXF5L0J1UHRPTjZwWmZTdlRQb0JVWVNvamxWTEk1eHhWeUZ3YitTMWM0OUd1UkhqUXB4YjNjQ0JYMG96NmZIdkhNbEdEZTlraUVpV1EwSlJiMXM1Nk1FN2plMUpYcGNTT2Q0WUR5TVdqb3VpbDVUUDdJYVJqL2x4SkxnbnRBS293U3N0OFMzYXJIUmhxanZraEVld1o2V1UyQzBtbXh5RHlVZnlnMWFoY25Nck41bS9oM2t4azNzbGd5cU56MVlJVXp4c1lVUzVHckpjOG5qK3lHUEMwR2F4V2VvWDBuRUN0SXVaOENYZmRYbzM3bTU2eUg0czdXYk5obmRhTGlZRE0rSW5UMVc0MmxXSXk5SnNJbGhySkhJazZOWjE3YThEVUt2Q1ZKTGRMWjduYTdVZEZPdFl1cTRGa2FDTi8zTSs2dTU1bUEvSWFFYWJ2L1ZFRmVEWng0V2hYY0JaYm8wZ0RPdlJFN1FFNGpjUmwzc21PMTk1MXFtbWN2cEFsbTdCVXZOQmZXYzl0S2pnc0Q5b005NERkeXRkZldTZ2xIWnpDSUU3aExVZTBmTVNhMS9xMUkzd3E2Mm0wa3NzNnd0VDNWM1QzQ1NSLys0VzFpODhVMlVpdWNoSWlXUjIzbWliVFp3Wk5DQjM0Q1ptU09PWmF1aWpBdFIyakltclNpVHpQOWFqeDBoNzV1Rm1EZGhrT25VSlVXa2k4SnBsK2ZLc2V0K1ppSHhEck9IRGs9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * WJmo7
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Documents\JZZ5R_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .BDCDCDDDCc You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTU4LWRGOUw0T0IwMm4wcnhhWEZGVkZqRUE5OU9PVHg2MWxZU3pSVjJkdW9qNVBYdTBFWlE4VmJqZFJQQmVIWlpGK3lsU3NBeDUveGZUQllBazdrSWRSSUJXQ2E3TVBvSFVrRkFqdjRaamhObG9xZzFUMVludlBDeEdtcWVhTkg3dmtaN3dDaUx0N0Y0VlNpd2pnZG1HK04rd0p5OEpob3V0dVQyNDdZd3NuR2tpb0pOaEptVCt1ZVJHSTZPcmNJYnFjbVdIR00veFBRT2ZHV3JrMzZDemRqc3ROMWNnMkl1L21KOCsvVUxObjhvYncybmR6d2hESTVVNUVDWUs2My8xZDdNRmwrMCtOclV3ZjBwSE1udEpwcTA3d0c0YWtpdUhQYm1pS2dCemt3a2JsRnZVaUg4d2tMQ1hqTDc0eGZhOXA3UE4yMU96TWVNOGZUdXJiUVplWFVYdjRQOWVBVEZLY1JBMjZJMzN2cEM4eDdpVTVpUWx1Z1FwUmRvM2xKc1RkMjJyMXBVN3lNaVhQL3JhallpZ2hLYUlOOUVTNWdoRzdKVDBrRnk3emNzajZZa1BCcEFCalBaSUpKb3hreUxjNHQ2Y2FKN3Y2b0ZuYTVJaEt6d3QrdndtTjlzQ2VOMEJNQU1ZRXJ6TUhpT0cyNTR2K0VNdEFOZEdHc2FKRWFTUFRneW9JQ0U2ZTlHRWg2ZFJST2xlbjhQNmxDK3BueVY1QmVTNjNlbVJsYUVMeTFsUEs3YlRsVXQwVGhkVVR6YmNmeHF5OUlmZERBcDZlZWNGY01UY2YyYk1oWW1KL0hoa2tFaDFEam9hRFVOazg0R1ZpdGVhcjJKNjFMaC9JUVFLWVdyN01ienRPNWVHN2JwQVZWd0F2TnR5L2FSM24wUkxCYWdpTVlwM3l5aUdZaFloNFE5SGE3cWk2bit5bG1kcFFZOHl5ZTh0eFVUbWpwTEtJN0VvTExmQmU5YmY0b0JHM0ZoR1hwc3F3d3RRSmN1UDJaSVF0amdzY1VzRDNPYUZzc09wYkZOWmUrR2N1bit2MTVpbDM0RmRZYjFYZTBaM0FLZXJFUm9ST2NRY1ZIYTFIUDJFd2JJRm52dHdUMk5iNVhzTCtCbGFNMjlmaFpFbFNIcjJVRmk4a2JldExiSFpNWFZDWkRhYVBGOHFFczBLN3BPZmlwV3luNGNucXEzUlA3bXNXb1pqbzc3SlNjWG1rQi9mdm1KMGI1eDNrbWl6cDVqdmQzM3M4TEh2dkhkQURJci9kM3BuUUNvZkFiUjVOekQ2Sno4S2tMOWcyNk8vMVJJWC9INlgvRmF4WCtJMHUzem03ajFQRkxLVXhod2hWUkc5ZjRZQUFWblNaaTJIbXF5L0J1UHRPTjZwWmZTdlRQb0JVWVNvamxWTEk1eHhWeUZ3YitTMWM0OUd1UkhqUXB4YjNjQ0JYMG96NmZIdkhNbEdEZTlraUVpV1EwSlJiMXM1Nk1FN2plMUpYcGNTT2Q0WUR5TVdqb3VpbDVUUDdJYVJqL2x4SkxnbnRBS293U3N0OFMzYXJIUmhxanZraEVld1o2V1UyQzBtbXh5RHlVZnlnMWFoY25Nck41bS9oM2t4azNzbGd5cU56MVlJVXp4c1lVUzVHckpjOG5qK3lHUEMwR2F4V2VvWDBuRUN0SXVaOENYZmRYbzM3bTU2eUg0czdXYk5obmRhTGlZRE0rSW5UMVc0MmxXSXk5SnNJbGhySkhJazZOWjE3YThEVUt2Q1ZKTGRMWjduYTdVZEZPdFl1cTRGa2FDTi8zTSs2dTU1bUEvSWFFYWJ2L1ZFRmVEWng0V2hYY0JaYm8wZ0RPdlJFN1FFNGpjUmwzc21PMTk1MXFtbWN2cEFsbTdCVXZOQmZXYzl0S2pnc0Q5b005NERkeXRkZldTZ2xIWnpDSUU3aExVZTBmTVNhMS9xMUkzd3E2Mm0wa3NzNnd0VDNWM1QzQ1NSLys0VzFpODhVMlVpdWNoSWlXUjIzbWliVFp3Wk5DQjM0Q1ptU09PWmF1aWpBdFIyakltclNpVHpQOWFqeDBoNzV1Rm1EZGhrT25VSlVXa2k4SnBsK2ZLc2V0K1ppSHhEck9IRGs9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * swteRW8C
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Pictures\JZZ5R_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .BDCDCDDDCc You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTU4LWRGOUw0T0IwMm4wcnhhWEZGVkZqRUE5OU9PVHg2MWxZU3pSVjJkdW9qNVBYdTBFWlE4VmJqZFJQQmVIWlpGK3lsU3NBeDUveGZUQllBazdrSWRSSUJXQ2E3TVBvSFVrRkFqdjRaamhObG9xZzFUMVludlBDeEdtcWVhTkg3dmtaN3dDaUx0N0Y0VlNpd2pnZG1HK04rd0p5OEpob3V0dVQyNDdZd3NuR2tpb0pOaEptVCt1ZVJHSTZPcmNJYnFjbVdIR00veFBRT2ZHV3JrMzZDemRqc3ROMWNnMkl1L21KOCsvVUxObjhvYncybmR6d2hESTVVNUVDWUs2My8xZDdNRmwrMCtOclV3ZjBwSE1udEpwcTA3d0c0YWtpdUhQYm1pS2dCemt3a2JsRnZVaUg4d2tMQ1hqTDc0eGZhOXA3UE4yMU96TWVNOGZUdXJiUVplWFVYdjRQOWVBVEZLY1JBMjZJMzN2cEM4eDdpVTVpUWx1Z1FwUmRvM2xKc1RkMjJyMXBVN3lNaVhQL3JhallpZ2hLYUlOOUVTNWdoRzdKVDBrRnk3emNzajZZa1BCcEFCalBaSUpKb3hreUxjNHQ2Y2FKN3Y2b0ZuYTVJaEt6d3QrdndtTjlzQ2VOMEJNQU1ZRXJ6TUhpT0cyNTR2K0VNdEFOZEdHc2FKRWFTUFRneW9JQ0U2ZTlHRWg2ZFJST2xlbjhQNmxDK3BueVY1QmVTNjNlbVJsYUVMeTFsUEs3YlRsVXQwVGhkVVR6YmNmeHF5OUlmZERBcDZlZWNGY01UY2YyYk1oWW1KL0hoa2tFaDFEam9hRFVOazg0R1ZpdGVhcjJKNjFMaC9JUVFLWVdyN01ienRPNWVHN2JwQVZWd0F2TnR5L2FSM24wUkxCYWdpTVlwM3l5aUdZaFloNFE5SGE3cWk2bit5bG1kcFFZOHl5ZTh0eFVUbWpwTEtJN0VvTExmQmU5YmY0b0JHM0ZoR1hwc3F3d3RRSmN1UDJaSVF0amdzY1VzRDNPYUZzc09wYkZOWmUrR2N1bit2MTVpbDM0RmRZYjFYZTBaM0FLZXJFUm9ST2NRY1ZIYTFIUDJFd2JJRm52dHdUMk5iNVhzTCtCbGFNMjlmaFpFbFNIcjJVRmk4a2JldExiSFpNWFZDWkRhYVBGOHFFczBLN3BPZmlwV3luNGNucXEzUlA3bXNXb1pqbzc3SlNjWG1rQi9mdm1KMGI1eDNrbWl6cDVqdmQzM3M4TEh2dkhkQURJci9kM3BuUUNvZkFiUjVOekQ2Sno4S2tMOWcyNk8vMVJJWC9INlgvRmF4WCtJMHUzem03ajFQRkxLVXhod2hWUkc5ZjRZQUFWblNaaTJIbXF5L0J1UHRPTjZwWmZTdlRQb0JVWVNvamxWTEk1eHhWeUZ3YitTMWM0OUd1UkhqUXB4YjNjQ0JYMG96NmZIdkhNbEdEZTlraUVpV1EwSlJiMXM1Nk1FN2plMUpYcGNTT2Q0WUR5TVdqb3VpbDVUUDdJYVJqL2x4SkxnbnRBS293U3N0OFMzYXJIUmhxanZraEVld1o2V1UyQzBtbXh5RHlVZnlnMWFoY25Nck41bS9oM2t4azNzbGd5cU56MVlJVXp4c1lVUzVHckpjOG5qK3lHUEMwR2F4V2VvWDBuRUN0SXVaOENYZmRYbzM3bTU2eUg0czdXYk5obmRhTGlZRE0rSW5UMVc0MmxXSXk5SnNJbGhySkhJazZOWjE3YThEVUt2Q1ZKTGRMWjduYTdVZEZPdFl1cTRGa2FDTi8zTSs2dTU1bUEvSWFFYWJ2L1ZFRmVEWng0V2hYY0JaYm8wZ0RPdlJFN1FFNGpjUmwzc21PMTk1MXFtbWN2cEFsbTdCVXZOQmZXYzl0S2pnc0Q5b005NERkeXRkZldTZ2xIWnpDSUU3aExVZTBmTVNhMS9xMUkzd3E2Mm0wa3NzNnd0VDNWM1QzQ1NSLys0VzFpODhVMlVpdWNoSWlXUjIzbWliVFp3Wk5DQjM0Q1ptU09PWmF1aWpBdFIyakltclNpVHpQOWFqeDBoNzV1Rm1EZGhrT25VSlVXa2k4SnBsK2ZLc2V0K1ppSHhEck9IRGs9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * j4V1mivzIr7
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Desktop\P4nyljPG_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .aBDAAcBDed You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTU4LWNKK1VkUTBxQzhtajFsMHorTU0rKzc5TXU4Q3dHUytWMUhmY2RlSnBkeUxZQTNQamUxWWpTQlJ4N3Q5eFIvR1QwMzE3ci8yMTFhUURQT2pabkF2NHJ5VnJ5ZHoxUGNtYktvNUVQU1ZERE8rdHJubXV4Ymgzb0lQVUJibktSN25UMkU3OHlXS3J1NThvU0xwVE54VjBhL0xCM2pReG5xYTFMSzF2dmc5WEFHc0NFSVczUFpwbzdmQ0s0SXBkL1JRVHZBU2wzZko1TG9QZVJsVlg3Z2laSlBONG0yQ3pCclNad3lERUF0aTYzaHozYjNET2toVWtQU3B3VFRFcVkvUk8vUE5PdFN2bnNPTWlVMTdLTW5naG01RGtEQlR0Yys0dncvMTZtUWwvQWIzaUZmQ201TzlqL3MyR2t2QXpBd2JLMzJZQmd5SHNvUWVkZm5hQXBmVnRONDVsTStLTlo4cUJrNFd5WDc4anFQakFiSmVJWk5BQllBbGtTMUhzRWtjOVRSTEJPY2JrR2ZyU00yWnplK3hSZi80U1V0cUR2alBza3BEaVlucUJibmo5VzZ4V3cwZHVhYktVeTFDQWIvV0ZwZ0RwaWZJYThEb0IxRFc1bGZ6VnlFU1R3alhtWmNoWEJ3M2ltSy8xZDBnR3k3NHdRN24wNXdUSkVPbjFNdmpiWDRsTVplb0JPUTVkeHd2Z2NsNkNDNXY5NnBsN3QwZ0FVVkVKWjdyWkVBVUhLVkpVUlM3Y2J0VzdqdU11WFcvZXVkVkp0YVExRzRoajdYbkRoclZmUi9YMzNya2tNREpOb0FsODdpaDk0bnhvbmY5QWxzNkZKUkYxUFdOR1U1cnpwdDhEeWhmejRaRk9wcFZLVXRDWm5ySU9iNXlzNldlTGpmUlphQXVidmRZWTdJRHE4b3pncUt5aGhYUVp0YXJJYjdoelJ6RE5kWldKdi9RdjFETERPL3pTSm5xc0RBQ0kxaE5yUlFyaHpmbUxMUUJycmo5b2Ntb1lTTWhQamxLU3Z2ZWdOMHNLOUtyZHYvLzJmZFJHNkQ5alduZEp3cG00TDZ6SU44a3h0bFVsdHEwRW1pL2JyNkZmMkVBZUN5UmNZdmc3Qmc1QnNUQkNwSmdQWFl5U21XY0trL2xoOVgzOWFiNHp1NkVPM0NmMHBZcXhnMHZmQUg1K04vRmNYSHI2K0Q5NkQwaXJjS2RhdEtyMExZeUN0cEs5ZDZqam5NZ2c0em5XcXMxR2o2U0NBSkJqaVNrUDVmdjV3am9XZWc4U0x2eUNNUkZ4NE53UnlUODZaaDI2N25HVlkwdzl6eUViTmdaL1FEZkVxSDFyOUF1eElyc2lFelRKSzlRdzNiVnFhZEZPQjNGUlFIZVd3cVBGZ0lzeEc0STBXczhWblIyQWRkMkxUSWRnNzVpRCszQTB5SmZOYmZHUFFxVlAxN3Y4bGdMOFdnV0JyVi9BY3lJblB4TFNVamJEaldSOEc3Q3NjSzRFdFVVL3daSWc2MElLdktxVE96aFd2MlI1VG9aTkNJcm15TnA1MlM5ZWExSy9vNkFhVnhkTU1zVm1oeUxidzhZQ1dFalB4UlVyVWplSWNTdGU5UkQ1TUZlTmU2VGw3aDlHUUNxSkJOZnovQ3F0dUdUN2QxSHAwelBRdGp0QUlramw0Qi9WbE5DUzQyb0ZEcGpKYVBzMDExOWNadWVUdUh5YUg5MjFMVGJWdDhySW5Hbmh3ZzJGTHNNeFEvQ21kMzRBdEJDY1lZSVAybDcwNjY2ZnR1cFNSeUY4cWFwNEVEYzBjTXBkT3NkZURocFJzT2QvRzRDZUphTGpWdkY0QW9BYUU0alB3RnNXeEJsOEFuNXYvc1d6dnByd0Fnc2pnTHZmU2VqTzRRWVhjeTVUSlZyUVlzWUZhYUE5RHBuUEVlZEpjMnhGYXBscEpxVGZUdVc0R1Fnei9meVRNWkVoa0xEa0ExTWNMWHBLZ1p4YUZiNkF3T1ArenU2U21pQlJ6c1VBQUg4YjZmaWlWVlBiS2p6VWhrV010SkhvVld0b1BuejlrWHE1Q2h2OHIvWUVCR2xTeWRFZnVFODdYdTVvYnBLdlBXUnBXOXM9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * zQ7Ylolhw6xEZ4vfEFK6cpNvAXu8r
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Downloads\P4nyljPG_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .aBDAAcBDed You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTU4LWNKK1VkUTBxQzhtajFsMHorTU0rKzc5TXU4Q3dHUytWMUhmY2RlSnBkeUxZQTNQamUxWWpTQlJ4N3Q5eFIvR1QwMzE3ci8yMTFhUURQT2pabkF2NHJ5VnJ5ZHoxUGNtYktvNUVQU1ZERE8rdHJubXV4Ymgzb0lQVUJibktSN25UMkU3OHlXS3J1NThvU0xwVE54VjBhL0xCM2pReG5xYTFMSzF2dmc5WEFHc0NFSVczUFpwbzdmQ0s0SXBkL1JRVHZBU2wzZko1TG9QZVJsVlg3Z2laSlBONG0yQ3pCclNad3lERUF0aTYzaHozYjNET2toVWtQU3B3VFRFcVkvUk8vUE5PdFN2bnNPTWlVMTdLTW5naG01RGtEQlR0Yys0dncvMTZtUWwvQWIzaUZmQ201TzlqL3MyR2t2QXpBd2JLMzJZQmd5SHNvUWVkZm5hQXBmVnRONDVsTStLTlo4cUJrNFd5WDc4anFQakFiSmVJWk5BQllBbGtTMUhzRWtjOVRSTEJPY2JrR2ZyU00yWnplK3hSZi80U1V0cUR2alBza3BEaVlucUJibmo5VzZ4V3cwZHVhYktVeTFDQWIvV0ZwZ0RwaWZJYThEb0IxRFc1bGZ6VnlFU1R3alhtWmNoWEJ3M2ltSy8xZDBnR3k3NHdRN24wNXdUSkVPbjFNdmpiWDRsTVplb0JPUTVkeHd2Z2NsNkNDNXY5NnBsN3QwZ0FVVkVKWjdyWkVBVUhLVkpVUlM3Y2J0VzdqdU11WFcvZXVkVkp0YVExRzRoajdYbkRoclZmUi9YMzNya2tNREpOb0FsODdpaDk0bnhvbmY5QWxzNkZKUkYxUFdOR1U1cnpwdDhEeWhmejRaRk9wcFZLVXRDWm5ySU9iNXlzNldlTGpmUlphQXVidmRZWTdJRHE4b3pncUt5aGhYUVp0YXJJYjdoelJ6RE5kWldKdi9RdjFETERPL3pTSm5xc0RBQ0kxaE5yUlFyaHpmbUxMUUJycmo5b2Ntb1lTTWhQamxLU3Z2ZWdOMHNLOUtyZHYvLzJmZFJHNkQ5alduZEp3cG00TDZ6SU44a3h0bFVsdHEwRW1pL2JyNkZmMkVBZUN5UmNZdmc3Qmc1QnNUQkNwSmdQWFl5U21XY0trL2xoOVgzOWFiNHp1NkVPM0NmMHBZcXhnMHZmQUg1K04vRmNYSHI2K0Q5NkQwaXJjS2RhdEtyMExZeUN0cEs5ZDZqam5NZ2c0em5XcXMxR2o2U0NBSkJqaVNrUDVmdjV3am9XZWc4U0x2eUNNUkZ4NE53UnlUODZaaDI2N25HVlkwdzl6eUViTmdaL1FEZkVxSDFyOUF1eElyc2lFelRKSzlRdzNiVnFhZEZPQjNGUlFIZVd3cVBGZ0lzeEc0STBXczhWblIyQWRkMkxUSWRnNzVpRCszQTB5SmZOYmZHUFFxVlAxN3Y4bGdMOFdnV0JyVi9BY3lJblB4TFNVamJEaldSOEc3Q3NjSzRFdFVVL3daSWc2MElLdktxVE96aFd2MlI1VG9aTkNJcm15TnA1MlM5ZWExSy9vNkFhVnhkTU1zVm1oeUxidzhZQ1dFalB4UlVyVWplSWNTdGU5UkQ1TUZlTmU2VGw3aDlHUUNxSkJOZnovQ3F0dUdUN2QxSHAwelBRdGp0QUlramw0Qi9WbE5DUzQyb0ZEcGpKYVBzMDExOWNadWVUdUh5YUg5MjFMVGJWdDhySW5Hbmh3ZzJGTHNNeFEvQ21kMzRBdEJDY1lZSVAybDcwNjY2ZnR1cFNSeUY4cWFwNEVEYzBjTXBkT3NkZURocFJzT2QvRzRDZUphTGpWdkY0QW9BYUU0alB3RnNXeEJsOEFuNXYvc1d6dnByd0Fnc2pnTHZmU2VqTzRRWVhjeTVUSlZyUVlzWUZhYUE5RHBuUEVlZEpjMnhGYXBscEpxVGZUdVc0R1Fnei9meVRNWkVoa0xEa0ExTWNMWHBLZ1p4YUZiNkF3T1ArenU2U21pQlJ6c1VBQUg4YjZmaWlWVlBiS2p6VWhrV010SkhvVld0b1BuejlrWHE1Q2h2OHIvWUVCR2xTeWRFZnVFODdYdTVvYnBLdlBXUnBXOXM9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * p
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Searches\P4nyljPG_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .aBDAAcBDed You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTU4LWNKK1VkUTBxQzhtajFsMHorTU0rKzc5TXU4Q3dHUytWMUhmY2RlSnBkeUxZQTNQamUxWWpTQlJ4N3Q5eFIvR1QwMzE3ci8yMTFhUURQT2pabkF2NHJ5VnJ5ZHoxUGNtYktvNUVQU1ZERE8rdHJubXV4Ymgzb0lQVUJibktSN25UMkU3OHlXS3J1NThvU0xwVE54VjBhL0xCM2pReG5xYTFMSzF2dmc5WEFHc0NFSVczUFpwbzdmQ0s0SXBkL1JRVHZBU2wzZko1TG9QZVJsVlg3Z2laSlBONG0yQ3pCclNad3lERUF0aTYzaHozYjNET2toVWtQU3B3VFRFcVkvUk8vUE5PdFN2bnNPTWlVMTdLTW5naG01RGtEQlR0Yys0dncvMTZtUWwvQWIzaUZmQ201TzlqL3MyR2t2QXpBd2JLMzJZQmd5SHNvUWVkZm5hQXBmVnRONDVsTStLTlo4cUJrNFd5WDc4anFQakFiSmVJWk5BQllBbGtTMUhzRWtjOVRSTEJPY2JrR2ZyU00yWnplK3hSZi80U1V0cUR2alBza3BEaVlucUJibmo5VzZ4V3cwZHVhYktVeTFDQWIvV0ZwZ0RwaWZJYThEb0IxRFc1bGZ6VnlFU1R3alhtWmNoWEJ3M2ltSy8xZDBnR3k3NHdRN24wNXdUSkVPbjFNdmpiWDRsTVplb0JPUTVkeHd2Z2NsNkNDNXY5NnBsN3QwZ0FVVkVKWjdyWkVBVUhLVkpVUlM3Y2J0VzdqdU11WFcvZXVkVkp0YVExRzRoajdYbkRoclZmUi9YMzNya2tNREpOb0FsODdpaDk0bnhvbmY5QWxzNkZKUkYxUFdOR1U1cnpwdDhEeWhmejRaRk9wcFZLVXRDWm5ySU9iNXlzNldlTGpmUlphQXVidmRZWTdJRHE4b3pncUt5aGhYUVp0YXJJYjdoelJ6RE5kWldKdi9RdjFETERPL3pTSm5xc0RBQ0kxaE5yUlFyaHpmbUxMUUJycmo5b2Ntb1lTTWhQamxLU3Z2ZWdOMHNLOUtyZHYvLzJmZFJHNkQ5alduZEp3cG00TDZ6SU44a3h0bFVsdHEwRW1pL2JyNkZmMkVBZUN5UmNZdmc3Qmc1QnNUQkNwSmdQWFl5U21XY0trL2xoOVgzOWFiNHp1NkVPM0NmMHBZcXhnMHZmQUg1K04vRmNYSHI2K0Q5NkQwaXJjS2RhdEtyMExZeUN0cEs5ZDZqam5NZ2c0em5XcXMxR2o2U0NBSkJqaVNrUDVmdjV3am9XZWc4U0x2eUNNUkZ4NE53UnlUODZaaDI2N25HVlkwdzl6eUViTmdaL1FEZkVxSDFyOUF1eElyc2lFelRKSzlRdzNiVnFhZEZPQjNGUlFIZVd3cVBGZ0lzeEc0STBXczhWblIyQWRkMkxUSWRnNzVpRCszQTB5SmZOYmZHUFFxVlAxN3Y4bGdMOFdnV0JyVi9BY3lJblB4TFNVamJEaldSOEc3Q3NjSzRFdFVVL3daSWc2MElLdktxVE96aFd2MlI1VG9aTkNJcm15TnA1MlM5ZWExSy9vNkFhVnhkTU1zVm1oeUxidzhZQ1dFalB4UlVyVWplSWNTdGU5UkQ1TUZlTmU2VGw3aDlHUUNxSkJOZnovQ3F0dUdUN2QxSHAwelBRdGp0QUlramw0Qi9WbE5DUzQyb0ZEcGpKYVBzMDExOWNadWVUdUh5YUg5MjFMVGJWdDhySW5Hbmh3ZzJGTHNNeFEvQ21kMzRBdEJDY1lZSVAybDcwNjY2ZnR1cFNSeUY4cWFwNEVEYzBjTXBkT3NkZURocFJzT2QvRzRDZUphTGpWdkY0QW9BYUU0alB3RnNXeEJsOEFuNXYvc1d6dnByd0Fnc2pnTHZmU2VqTzRRWVhjeTVUSlZyUVlzWUZhYUE5RHBuUEVlZEpjMnhGYXBscEpxVGZUdVc0R1Fnei9meVRNWkVoa0xEa0ExTWNMWHBLZ1p4YUZiNkF3T1ArenU2U21pQlJ6c1VBQUg4YjZmaWlWVlBiS2p6VWhrV010SkhvVld0b1BuejlrWHE1Q2h2OHIvWUVCR2xTeWRFZnVFODdYdTVvYnBLdlBXUnBXOXM9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * CAJl
URLs

http://avaddonbotrxmuyl.onion

Targets

    • Target

      taskhost.exe

    • Size

      1.1MB

    • MD5

      255f4b48567937bc0373af60bef975b3

    • SHA1

      93da8a8a67965a9b5cd3f3a9de9f333a541d9dc7

    • SHA256

      d6642e896600cb29365f61dfe28c94c6f075bf90b34cbdf6ff5466756e33eb0d

    • SHA512

      8bee1b0a91eb40d9d613d8e4fc2bff9bdbc1175fa78eda67178dae04aae7700cc219a195eb5cc99ea21290a43f7dfac4c557a58a350a77bebaad2e69d6e8b885

    • Avaddon

      Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

    • Avaddon Ransomware

    • UAC bypass

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Enumerates connected drives

    • Modifies service

MITRE ATT&CK Enterprise v6

Tasks