Overview

overview

10

Static

static

download.exe

windows7_x64

10

download.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    download

  • Size

    882KB

  • Sample

    210420-yx495l37hn

  • MD5

    c65ce4ba6d977022056272ffc86f51d4

  • SHA1

    3811485a7d4ad5f551d844b81e15f44f00515cba

  • SHA256

    194d34ae7ddcfa9918c1230cda4615d275baf0bb1a2bb2e0c2c5fb70a87ff4fa

  • SHA512

    7792da612d84add79a3972f72a9580ab6a72e9624de43d708cf014d391ead9c415b7362853c18b6a855960bb000928a850b71f9a966575db9c2650094edf38d7

Score
10/10
avaddonevasionpersistenceransomwaretrojan

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\readme.html

Family

avaddon

Ransom Note
Your network has been infected by Avaddon All your documents, photos, databases and other important files have been encrypted and you are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software - Avaddon General Decryptor . Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page Download Tor browser - https://www.torproject.org/ Install Tor browser Open link in Tor browser - dYfWDRncG.avaddonbotrxmuyl.onion/?uAuaZIE1Uc3SGG3p6xJBIDc01kIQ61 Follow the instructions on this page Your ID: MTU1LXhTVlM0bHlpWHBUM2lCbmwyLzBNNHhFM1VYa0hncnRzWGNJYzl4aDcwZzgzL1VnejJFWEVxQ0o1OTdMbWlHYUpsWWdURFNQYWI0ZllCWHNNWlo1bHdVaEFha2xXdVdVNndkeDMvZ05iUmp6R3pnTENtT2xmcGk3SE9QR1lIWnVGOHFlUStHRGNKb29iN3FRcTdMOFhiTkxTdlFNS0x1WWU2L0pKUG5ubXNsQTRRR1BhaitSYkNwc0g5SUFQVjVieDdSZDg3L3I2Y29NZjBwdWtsZFdpMDlLOFRsb1NPWUZTMUNZT0VRSGw0eVRuWlloWUR3Q0Rka3g2czRVajdOVHJsampZRXdVUlJXS01vaXhXTmQvQ2ZwL3ducW0rbmFRYnZsNnBTdWhnbURCMUwyclJiVkNLMVFGYnZaNWxLTnJJbDFLSlFkb3I4V2JjZ2s5dFVsMEVISi9yWlFHRDQvL2JrU3lyQ3pGT3I5WWlKNnJnQ0gxdEVUK1oxTU5SUmRGbUEvd1NOMXZxT0VqVzVFd3VXNlVFdEtUdVgzOE92SmV6aUJhaFh2M3ZvcklKdDBvVGNUREc4VkhMUTVKSm5xZGNIYVZHRVphYVN4Rjk2WGZLc0toODRid0JpTjBFMDVpdW53N0JISFU0bWNRV2ZJTUZDOFJOZS9zSytZNVhpZFNSOUVIWXNtSFRpQ3MxTVpHcFBkM1BTM1NuWjNIM3VZN2pBWnV5S2ZNZE5jSjMzR29QeEszSHNCNkNzT0FJaXVERVBzS2pvOUdEY0hkWisxbXNuZUZleXV4ZGNmUzZGRzRZN2lWdU5WcnVwY1VRMlgyem50N3QwTy9FVC9BY0F3UGNrZkxTOGJ4TS90akNySXExeUo5Z0NzMVlzLzhueWFXL1RtZVdrZm9jcGpuc1c2OUNWaVliUFFINDNOYmVIdDl4OXg4TGNJbkV0aDdONkxXL3FINGU5ZTVvbWlRbVRBRHd5UjN4RFZjdXc2VnViMHk4UXdHaTRSU2tUc2o1OFE1WGU4K3hMdHpoNEM0R0dCbkY2Z3VSWTdYaWF3V2NIeVR4clRkbFk2YmExMGE2U1lPVEgyODdvMjhGdVBKUU5RMlh1S21RTXRrYVl1ak9oTmt1N1ZiREJUcEhpWHFPeGppYk44WWxhdStoTHdjS3lsanBkZVZwQjdFdUVZNkd2OVFpYUxWK083bHJZeWY5TjN0T3Y4eGpkL0ZxeUNtbkNOQnBLalIvMk1lalJNekRiSTNsT0d6cm1vY0drdkNOTE1YRCtIcGpVVXhRT0pRSVVZZkJrcG5jWjA2V1lhQ3ptTDE2TDg5cWFsSVNZN202UGRJNFVVa2JQcmY5VEp4V0ZlRmRWSXplbTFWb2tORWp0SSt3Q1VHMnNPTWFtNSs0SmlLYUE1K1ZDM3lDMXRBRklkZVg5bW9YR21OM1g1UU9RZXNOdHl0SUoweVM5dFpnUE5zK3VtY2RiZEFiaVFLeGdZdFNJc2pwdVN1akp5dWQxeGhlT1habW5XTEFwTWV3TVk5eDM5QmNoRWUxSmwvOEpCMFFwaE5lbnBHT0tTdmZ4M3VJNUU2bEVXc3VZK3o1bVJuUmRBQWh0bzR3RnpVZW1rS3dEWHhiRVRtalRDNFE0MU9ZU2Z6U2pBWjRPUWVBdVFqbnJEYncwNU1KUitnR0tZbFdnTUhGQlFkRmxFMUljYUxTRmZRQ2RSa3R0dGR5QThmbHZWaWNFYTg0eGkvQWd0dXhyTGptcUxyQ1V4OUtIZDhOYzFQcjJLcFptemZPd2dkaWtHanlKV2hSWTNsSXlVbDRVcU50QTQ0MjZPT0YyU3ZmZmtDQzNSV3VoNlZuTTJJelJXdVl2RG0vZFhyVFo1VW5TNW83UTZWMkFrenhmZ0ZLOTBHWExzNlIyUnFVQlpJZ2U4b0RDTVltQWREYldra0pKRnpqWVc5T05JclhCRmc4ajNxazVDbzhkM09LcjQ3SFljazkySUpWSWRFaGdHTURiaGFXQkhWU21OTCttaFFldGZnektNbjZuVXNVdW9rNTI4QWV4TnZDUDk4b09FZ3prSG9PZ05Lc0dNWUNTb0xoZk5Mamo1RFpIa2s9 Do not try to recover files yourself! Do not modify encrypted files! Otherwise, you may lose all your files forever!

Targets

    • Target

      download

    • Size

      882KB

    • MD5

      c65ce4ba6d977022056272ffc86f51d4

    • SHA1

      3811485a7d4ad5f551d844b81e15f44f00515cba

    • SHA256

      194d34ae7ddcfa9918c1230cda4615d275baf0bb1a2bb2e0c2c5fb70a87ff4fa

    • SHA512

      7792da612d84add79a3972f72a9580ab6a72e9624de43d708cf014d391ead9c415b7362853c18b6a855960bb000928a850b71f9a966575db9c2650094edf38d7

    Score
    10/10
    evasionpersistenceransomwaretrojanavaddon

    • Avaddon

      Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

      ransomwareavaddon

    • UAC bypass

      evasiontrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

4
T1112

File Deletion

2
T1107

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2
T1490

Tasks