General

  • Target

    6c68f61ddd1c17b8bef5080ee8b113ebaa90c415a11a137f74a73429fb79877d

  • Size

    714KB

  • Sample

    210528-7vg1arx6jj

  • MD5

    c497f83e28e9f3a7fdebc64ab1a1ea23

  • SHA1

    4eee6846c84fb3eb1b73ca085a9ee016aa0bedb9

  • SHA256

    6c68f61ddd1c17b8bef5080ee8b113ebaa90c415a11a137f74a73429fb79877d

  • SHA512

    b761e1e9de8e2a1ad43ef86b3adf0839bdda26f02edcd7aaf701cbf930c38d8a9381794f6e2edc6959ef1ce23a23d3b68640c737ab817a03d533db1e3004dd42

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\1zvQ4_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .abAdbddcDA You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTg2LUpzQ280bmZXS1A5RmVlWXBPK0YxUUl6WXlaMWNJQjcvVTlzYjdYMEhIMlJERUMxQnUxV2dFa1dMek9heC8zQUtCTGV2QTVaSnp1d0h2WGRUYXR3S2FQRWhmdXNpV0lleldJTFI4SlNsKytiZ1k0azRXQ3dJTUw1YVkrV0cybytnVW1YdmNzM2FXRHJ3Y3UrdlBlS09qdlh6RUkrMkY0elJyYTN0RGNtcUl3VCtFVlNTemh0a1ZPTFRxWktDUlBZM3krWXhqbGlnUWRvQkhXcE05T01lam1qZ2hIK1BPRXZ2d3FDc1Jhb2FFSDliNjBjVmJFVjQ4WWxvckd0aEMwNGpOcjFPSzJmVWNyZk95R3ZnNDZlZnFYZWE0VjhGaGxUUWVYM1J4SEtSTUQvcDR5TlkvbXBJeTFiUmpnWUJGMlJEVnhsUTN2WkdzTFpzTmJUc0hSSXc4RjdNWHlyRHJMaUlOSzg1MldWSDBmM3FWa0lWYUxzdFBYdmZWeTVRNmg5YTNJU1FSTVowaVJoSFFiVWIvZEZuK3UyOUEvd0hvM3NzMlUxdXhqVTV6UVhWRW1RUzNaWWpMVkF6V2tLRnBiaUxOaWxkcEJPNisrRml2eEhPWE42c2pKNmlFNlB2NWNyK2s0bTJCbG9JUVdmR09EcFVYYXpqSHR5OG51THVSdmloQkRLNFIyWTd2bCs5TC9ZUHBjcVNmeU5zM1c4QWlITnBBU0dHaHlZbmVzWHJlYzFrc1JoRzNwN0N6WGFKTmpMTCtpajNkMUpvMmlPOXJGeTNqRlBYK0FBaVZWbnVWZ2x6dVpCOFZqQUZJU3dDRWRRdDVOSURjdlhjVmFKc0FyVHA4Zk1RdHJhaGhIVWJ6SVY1N2VlODVDcjh2SkJMUTRWSllIUjk1Ym1xMmNwY3VzK1pXanBCbVFIWmM5UzJPYVVUOWgxdTA4RjVkV2NHN2NNOWtHODZvbXM1S25JQ1ZPdHRoZ2ZCRHBqM1lydGM5TFJPK1AybzN2SDZSVzllQUJBZi9HQ2lMbHNtV3ZNM1R2SmNSWGZML0FMN25DbDRXbHl6Q2QvajZXVXlxVDZaQ3BYSVhMTnFmVmxyZVJ0dldwb1JlZjMyUFlhV2Y4bGVEclg0ZW54Z1A4UzFLUmMzMkdtOTBwbWhWdEVFdnFhR1BEMjBZWnNiYkdicFJlQWthbHpWYnRPVUxHNFRKaUROT1V4U2NNZVgzRGN6MWE4d2VNV251Yk4vUFpENEZvRmUvZGU0c0dlZURFRmEwNHg2NFlPREZjckQrRE1CUm9nM2RYeVdOaFk5VnlHSmtVcGtPblNhQWUyanhONWlWNUFXb2IxQ2FTUEN6UTdQTE5UNWh3Q0NwMG85N2lOQUNad090ZWpOUWErTUhnU3QyYzM1bXdPSllLUTN5a0Z1VVNxaUpTTXhwRUNpZyt5Ukl2ajBrSTBuUG9IRmpKQUZ6eC85d1JLOGg0WlFCVk5tT1F3M2lIRTEwN2tGVDlDNnR4SlVDWWRLZ0REOXJpMDhLVnplOWJ0SHRPamI3WFF6K2xTMDdWV2xtbzRpcExpWnJlUitDVTJXNndiQkYyaXVIOWRNWmsrcVVsMlg0VmN1ekV0VUloVWcrU0dqNGZ2RlUxblpyMHkvOG9SRGJqQVJCSGdzQ0Nmck9JR1VCVEVpeHlzOTlxbHUwRWsvbGdoUnhSM25XMk9NU0JhSCtWdk5pK2dmUzFVbU9jWFpyem0zS2luQkVERGxuY1dHQUZSSTRNcmJJZTZpeTV2STFiam1Zb2pIcjQwMEJXa3VRbnc4N2JvdlJFZ2ZJRm9Ocmw0R3N3TTFXV1ZIZldWam45ZmdQT0lpd2FTN2lSV25OWmE2THp3KzA0VnJrbEl6QldlVEh5UzNMbVMzWC83ZTlSb1lWOFordDZ4NFRMYXJoTUs4d2ZOa0xscmdmWWFZMkFTU0tCRG5yOUwzV1duZWNBMUtwN1dScko2L0Q4cHdPYmlsOTlseCtaWVZOdHBUWEFPdnpBdHZwWG4wYTFKMGxiTlY1VHE5SEgvKzduc1ZzVGZTV1A4cEh2WnpZTWJCSU41dmVLdUVUWEVFbHZlK1hNNVJWVDA9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * xUqMteI802Vux
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Favorites\Links\1zvQ4_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .abAdbddcDA You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTg2LUpzQ280bmZXS1A5RmVlWXBPK0YxUUl6WXlaMWNJQjcvVTlzYjdYMEhIMlJERUMxQnUxV2dFa1dMek9heC8zQUtCTGV2QTVaSnp1d0h2WGRUYXR3S2FQRWhmdXNpV0lleldJTFI4SlNsKytiZ1k0azRXQ3dJTUw1YVkrV0cybytnVW1YdmNzM2FXRHJ3Y3UrdlBlS09qdlh6RUkrMkY0elJyYTN0RGNtcUl3VCtFVlNTemh0a1ZPTFRxWktDUlBZM3krWXhqbGlnUWRvQkhXcE05T01lam1qZ2hIK1BPRXZ2d3FDc1Jhb2FFSDliNjBjVmJFVjQ4WWxvckd0aEMwNGpOcjFPSzJmVWNyZk95R3ZnNDZlZnFYZWE0VjhGaGxUUWVYM1J4SEtSTUQvcDR5TlkvbXBJeTFiUmpnWUJGMlJEVnhsUTN2WkdzTFpzTmJUc0hSSXc4RjdNWHlyRHJMaUlOSzg1MldWSDBmM3FWa0lWYUxzdFBYdmZWeTVRNmg5YTNJU1FSTVowaVJoSFFiVWIvZEZuK3UyOUEvd0hvM3NzMlUxdXhqVTV6UVhWRW1RUzNaWWpMVkF6V2tLRnBiaUxOaWxkcEJPNisrRml2eEhPWE42c2pKNmlFNlB2NWNyK2s0bTJCbG9JUVdmR09EcFVYYXpqSHR5OG51THVSdmloQkRLNFIyWTd2bCs5TC9ZUHBjcVNmeU5zM1c4QWlITnBBU0dHaHlZbmVzWHJlYzFrc1JoRzNwN0N6WGFKTmpMTCtpajNkMUpvMmlPOXJGeTNqRlBYK0FBaVZWbnVWZ2x6dVpCOFZqQUZJU3dDRWRRdDVOSURjdlhjVmFKc0FyVHA4Zk1RdHJhaGhIVWJ6SVY1N2VlODVDcjh2SkJMUTRWSllIUjk1Ym1xMmNwY3VzK1pXanBCbVFIWmM5UzJPYVVUOWgxdTA4RjVkV2NHN2NNOWtHODZvbXM1S25JQ1ZPdHRoZ2ZCRHBqM1lydGM5TFJPK1AybzN2SDZSVzllQUJBZi9HQ2lMbHNtV3ZNM1R2SmNSWGZML0FMN25DbDRXbHl6Q2QvajZXVXlxVDZaQ3BYSVhMTnFmVmxyZVJ0dldwb1JlZjMyUFlhV2Y4bGVEclg0ZW54Z1A4UzFLUmMzMkdtOTBwbWhWdEVFdnFhR1BEMjBZWnNiYkdicFJlQWthbHpWYnRPVUxHNFRKaUROT1V4U2NNZVgzRGN6MWE4d2VNV251Yk4vUFpENEZvRmUvZGU0c0dlZURFRmEwNHg2NFlPREZjckQrRE1CUm9nM2RYeVdOaFk5VnlHSmtVcGtPblNhQWUyanhONWlWNUFXb2IxQ2FTUEN6UTdQTE5UNWh3Q0NwMG85N2lOQUNad090ZWpOUWErTUhnU3QyYzM1bXdPSllLUTN5a0Z1VVNxaUpTTXhwRUNpZyt5Ukl2ajBrSTBuUG9IRmpKQUZ6eC85d1JLOGg0WlFCVk5tT1F3M2lIRTEwN2tGVDlDNnR4SlVDWWRLZ0REOXJpMDhLVnplOWJ0SHRPamI3WFF6K2xTMDdWV2xtbzRpcExpWnJlUitDVTJXNndiQkYyaXVIOWRNWmsrcVVsMlg0VmN1ekV0VUloVWcrU0dqNGZ2RlUxblpyMHkvOG9SRGJqQVJCSGdzQ0Nmck9JR1VCVEVpeHlzOTlxbHUwRWsvbGdoUnhSM25XMk9NU0JhSCtWdk5pK2dmUzFVbU9jWFpyem0zS2luQkVERGxuY1dHQUZSSTRNcmJJZTZpeTV2STFiam1Zb2pIcjQwMEJXa3VRbnc4N2JvdlJFZ2ZJRm9Ocmw0R3N3TTFXV1ZIZldWam45ZmdQT0lpd2FTN2lSV25OWmE2THp3KzA0VnJrbEl6QldlVEh5UzNMbVMzWC83ZTlSb1lWOFordDZ4NFRMYXJoTUs4d2ZOa0xscmdmWWFZMkFTU0tCRG5yOUwzV1duZWNBMUtwN1dScko2L0Q4cHdPYmlsOTlseCtaWVZOdHBUWEFPdnpBdHZwWG4wYTFKMGxiTlY1VHE5SEgvKzduc1ZzVGZTV1A4cEh2WnpZTWJCSU41dmVLdUVUWEVFbHZlK1hNNVJWVDA9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * J6xDEq5RqeDTKqb6S
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Pictures\1zvQ4_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .abAdbddcDA You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTg2LUpzQ280bmZXS1A5RmVlWXBPK0YxUUl6WXlaMWNJQjcvVTlzYjdYMEhIMlJERUMxQnUxV2dFa1dMek9heC8zQUtCTGV2QTVaSnp1d0h2WGRUYXR3S2FQRWhmdXNpV0lleldJTFI4SlNsKytiZ1k0azRXQ3dJTUw1YVkrV0cybytnVW1YdmNzM2FXRHJ3Y3UrdlBlS09qdlh6RUkrMkY0elJyYTN0RGNtcUl3VCtFVlNTemh0a1ZPTFRxWktDUlBZM3krWXhqbGlnUWRvQkhXcE05T01lam1qZ2hIK1BPRXZ2d3FDc1Jhb2FFSDliNjBjVmJFVjQ4WWxvckd0aEMwNGpOcjFPSzJmVWNyZk95R3ZnNDZlZnFYZWE0VjhGaGxUUWVYM1J4SEtSTUQvcDR5TlkvbXBJeTFiUmpnWUJGMlJEVnhsUTN2WkdzTFpzTmJUc0hSSXc4RjdNWHlyRHJMaUlOSzg1MldWSDBmM3FWa0lWYUxzdFBYdmZWeTVRNmg5YTNJU1FSTVowaVJoSFFiVWIvZEZuK3UyOUEvd0hvM3NzMlUxdXhqVTV6UVhWRW1RUzNaWWpMVkF6V2tLRnBiaUxOaWxkcEJPNisrRml2eEhPWE42c2pKNmlFNlB2NWNyK2s0bTJCbG9JUVdmR09EcFVYYXpqSHR5OG51THVSdmloQkRLNFIyWTd2bCs5TC9ZUHBjcVNmeU5zM1c4QWlITnBBU0dHaHlZbmVzWHJlYzFrc1JoRzNwN0N6WGFKTmpMTCtpajNkMUpvMmlPOXJGeTNqRlBYK0FBaVZWbnVWZ2x6dVpCOFZqQUZJU3dDRWRRdDVOSURjdlhjVmFKc0FyVHA4Zk1RdHJhaGhIVWJ6SVY1N2VlODVDcjh2SkJMUTRWSllIUjk1Ym1xMmNwY3VzK1pXanBCbVFIWmM5UzJPYVVUOWgxdTA4RjVkV2NHN2NNOWtHODZvbXM1S25JQ1ZPdHRoZ2ZCRHBqM1lydGM5TFJPK1AybzN2SDZSVzllQUJBZi9HQ2lMbHNtV3ZNM1R2SmNSWGZML0FMN25DbDRXbHl6Q2QvajZXVXlxVDZaQ3BYSVhMTnFmVmxyZVJ0dldwb1JlZjMyUFlhV2Y4bGVEclg0ZW54Z1A4UzFLUmMzMkdtOTBwbWhWdEVFdnFhR1BEMjBZWnNiYkdicFJlQWthbHpWYnRPVUxHNFRKaUROT1V4U2NNZVgzRGN6MWE4d2VNV251Yk4vUFpENEZvRmUvZGU0c0dlZURFRmEwNHg2NFlPREZjckQrRE1CUm9nM2RYeVdOaFk5VnlHSmtVcGtPblNhQWUyanhONWlWNUFXb2IxQ2FTUEN6UTdQTE5UNWh3Q0NwMG85N2lOQUNad090ZWpOUWErTUhnU3QyYzM1bXdPSllLUTN5a0Z1VVNxaUpTTXhwRUNpZyt5Ukl2ajBrSTBuUG9IRmpKQUZ6eC85d1JLOGg0WlFCVk5tT1F3M2lIRTEwN2tGVDlDNnR4SlVDWWRLZ0REOXJpMDhLVnplOWJ0SHRPamI3WFF6K2xTMDdWV2xtbzRpcExpWnJlUitDVTJXNndiQkYyaXVIOWRNWmsrcVVsMlg0VmN1ekV0VUloVWcrU0dqNGZ2RlUxblpyMHkvOG9SRGJqQVJCSGdzQ0Nmck9JR1VCVEVpeHlzOTlxbHUwRWsvbGdoUnhSM25XMk9NU0JhSCtWdk5pK2dmUzFVbU9jWFpyem0zS2luQkVERGxuY1dHQUZSSTRNcmJJZTZpeTV2STFiam1Zb2pIcjQwMEJXa3VRbnc4N2JvdlJFZ2ZJRm9Ocmw0R3N3TTFXV1ZIZldWam45ZmdQT0lpd2FTN2lSV25OWmE2THp3KzA0VnJrbEl6QldlVEh5UzNMbVMzWC83ZTlSb1lWOFordDZ4NFRMYXJoTUs4d2ZOa0xscmdmWWFZMkFTU0tCRG5yOUwzV1duZWNBMUtwN1dScko2L0Q4cHdPYmlsOTlseCtaWVZOdHBUWEFPdnpBdHZwWG4wYTFKMGxiTlY1VHE5SEgvKzduc1ZzVGZTV1A4cEh2WnpZTWJCSU41dmVLdUVUWEVFbHZlK1hNNVJWVDA9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * AiZZY3sFCGvYCGj8exgq
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\odt\q9yfv_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .aAEeCbeceB You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTg2LW9ZV1pWTlNwanlKWDZYUVBITVZTLzE2QWNPMXNwWXI1Mmx4L2haeHprZm9GNmt6ODIxS3hIY1B6QThFdS90ZFhWSHpGQnd3Q2pqU1BHaUxja2RJU2xtNmVaK2NHWU5qNTBkOVhXNU5vaS9KT0lNcFNiWVNkNW1Kb0Yvd2QyVDlNdk83NVQrWlBEMWtNdjlTTlcvS0NZZEFLZUdTVzEvTlNSNWdEcDdKQlRnQldJRFN6Z3RkOXBNVjZjTjU5ejhCZUpraXpSbEVuSnJoVlNUYjU5eGV5blZINlNWOUkrdkFFeGR5MFZiZGVXY09nQklqUVZBRVh0QkRSS0t0bHNYWTZOMlZpUGE4cW84dkJ0c2hvclB6RlNZc1c1clhKRmUxaFBtWVRLVUNDZThjeGR0Y2VSOWo1ZkF3UVYrdE5ta0tRREhyNS9HWFgzNHdUaXFsRkFuYy9JdjlaNlJqeEVaMG9kVndFMGFQd2FHZkluVmhTbnpZemtGajkwcjFjeVVoZFBPQmV0Y3RUdEdFZUJxaFFHR0c5V1lES3JNaVZmeDIvNTY4RGtFMWxDUFNSaUZkY2JZZ0E2aFpQUTlBY20zRXpUbk1PTm9CRGtrTkRRTWszUnFYNENwVkhsN2VCYzkzOE1VWG9JMUVwWkdScWxTSEV2blZqKyt6cU5nYm1XUU9ER0hDdTBWN0FRUEtNZUNHeEp6ZkQwNDNNVHdZRjhwT2tIem1qQUxEYzRQQ0tnQlkrSGJGNTFUZ3hCOTRFbXkxbDRLRkdOaHkzRVhPTnVZRkdrN2xDLzFGUFVnZHB5MlgzSkxhdXovckYrUGVIYklLTEV6MlF5MU14eDJzVnN6MGgrWDlYMDlVdGQzSkFKdDlMT2JiaG9iL3hUei84ZVVHNTVWbDRuSjRWT3d0MFJ0OXpybTNPYS9iaXhlYXZCQ1JFYXluNkpnazR1YjlLeGI4NnVWOEk2TnVrWGh5ZGRCdUhJZUR2QnBQd21ERExkTFFSS2s3TVhiOFE1T1BEeGFUR1JoSERVSXM5cHRiOUt3QVdwT2RyUThhMFlESGdzbk0vdHZ3RUwzby9SS0JjMHlITFh4eGtFbFROT1k1Z2h6V3EvNmh6MUtneE5ONGNjUmNTc0JnYjc5TDh3TWM3bHVoS0UvMGRrY01TdUVkc0FLR1ZTSUtaaUN4SjY1YVFWUHFXZE9PR1ZSUFJqYWhPWmVQMHFTaU1WNUM0TjZzaHVHL1F0WlZSVFRwWWw0SlpMZ2p5bnh6UlFRbzBxN0s1L1FORmZ0QjZDWW1TVHN2U1pPT2JxSG52TU8wY2JTNXNlZndEZFJveUJjREpmQmZhdmhPUnFqazNaQnlBTk9veUVyNmczd25ZcWxoZ3I1TzEzY202Ym1rQTBrQ1FMSHo4b0M0S1RkK0srd1ZxSHFLY1dZa1k0L0htNmxNNkQ1VUd6NWVCTWVSTlh5dCtERE9YL1dOdXBsZmRXLzEzaXRBeUwxMHF6dEVmVGxVK010Qm9zbkN5L2ROSjNCVXFzUmZXbjE1MWNqRCtkL3NhN25aajE0cXc4dFh5MjExS3c4Z0FMcitLa2lqc09LWC90YlhpMUlqTkV1U2dOOWZNQjk0OFI1VTViM05GbjNRWlRFeGJ3cjE2YlBuTjBtemhVWDRsRUNUOE94ZEw1cTMvM3dEQWFnb0xOd2FIbXdNZEtmNWh0OVhvcGFPU3pUNy9aeHZ2OVNuaGxUMUQ3UFAwL3FxZ2gzVW0vRUdRMWNzbHpZSHllMHlDZFBPSVVhalJ2MjNhMFQwODVnenBoWVZXYXM5Q3N5cFlMTWlWSmtXZUtCN0MrWFRYZjRDUTdPOEZJenl3dkRxdytPeGwvZllSeUoxMXFWQ2tXZVNvZit6RTRKZEpPMU5RNnY0cWxuS1p3TnMwY1BMQ3FJV3Z0MXdhekhiWmhGMzhBU0RLTEcxZmxlN2pFRCtRcFZDTHphM1lDM0xzbVI2YjlJOEl2Wmc0WU1aTkxMM3h2aDdaNGNkWGJrK25NaHhsVFFjT0laaUcwcmhXYWN2dVJDa1kwZXNTNDBTdDhxS1VjY0FUeFIxaFJWQXE3SXRuZXArVGJOcDVBQTg9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * P2IEPNPjpISH7A9iAkILdEWCU7yYlYr
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Downloads\q9yfv_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .aAEeCbeceB You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTg2LW9ZV1pWTlNwanlKWDZYUVBITVZTLzE2QWNPMXNwWXI1Mmx4L2haeHprZm9GNmt6ODIxS3hIY1B6QThFdS90ZFhWSHpGQnd3Q2pqU1BHaUxja2RJU2xtNmVaK2NHWU5qNTBkOVhXNU5vaS9KT0lNcFNiWVNkNW1Kb0Yvd2QyVDlNdk83NVQrWlBEMWtNdjlTTlcvS0NZZEFLZUdTVzEvTlNSNWdEcDdKQlRnQldJRFN6Z3RkOXBNVjZjTjU5ejhCZUpraXpSbEVuSnJoVlNUYjU5eGV5blZINlNWOUkrdkFFeGR5MFZiZGVXY09nQklqUVZBRVh0QkRSS0t0bHNYWTZOMlZpUGE4cW84dkJ0c2hvclB6RlNZc1c1clhKRmUxaFBtWVRLVUNDZThjeGR0Y2VSOWo1ZkF3UVYrdE5ta0tRREhyNS9HWFgzNHdUaXFsRkFuYy9JdjlaNlJqeEVaMG9kVndFMGFQd2FHZkluVmhTbnpZemtGajkwcjFjeVVoZFBPQmV0Y3RUdEdFZUJxaFFHR0c5V1lES3JNaVZmeDIvNTY4RGtFMWxDUFNSaUZkY2JZZ0E2aFpQUTlBY20zRXpUbk1PTm9CRGtrTkRRTWszUnFYNENwVkhsN2VCYzkzOE1VWG9JMUVwWkdScWxTSEV2blZqKyt6cU5nYm1XUU9ER0hDdTBWN0FRUEtNZUNHeEp6ZkQwNDNNVHdZRjhwT2tIem1qQUxEYzRQQ0tnQlkrSGJGNTFUZ3hCOTRFbXkxbDRLRkdOaHkzRVhPTnVZRkdrN2xDLzFGUFVnZHB5MlgzSkxhdXovckYrUGVIYklLTEV6MlF5MU14eDJzVnN6MGgrWDlYMDlVdGQzSkFKdDlMT2JiaG9iL3hUei84ZVVHNTVWbDRuSjRWT3d0MFJ0OXpybTNPYS9iaXhlYXZCQ1JFYXluNkpnazR1YjlLeGI4NnVWOEk2TnVrWGh5ZGRCdUhJZUR2QnBQd21ERExkTFFSS2s3TVhiOFE1T1BEeGFUR1JoSERVSXM5cHRiOUt3QVdwT2RyUThhMFlESGdzbk0vdHZ3RUwzby9SS0JjMHlITFh4eGtFbFROT1k1Z2h6V3EvNmh6MUtneE5ONGNjUmNTc0JnYjc5TDh3TWM3bHVoS0UvMGRrY01TdUVkc0FLR1ZTSUtaaUN4SjY1YVFWUHFXZE9PR1ZSUFJqYWhPWmVQMHFTaU1WNUM0TjZzaHVHL1F0WlZSVFRwWWw0SlpMZ2p5bnh6UlFRbzBxN0s1L1FORmZ0QjZDWW1TVHN2U1pPT2JxSG52TU8wY2JTNXNlZndEZFJveUJjREpmQmZhdmhPUnFqazNaQnlBTk9veUVyNmczd25ZcWxoZ3I1TzEzY202Ym1rQTBrQ1FMSHo4b0M0S1RkK0srd1ZxSHFLY1dZa1k0L0htNmxNNkQ1VUd6NWVCTWVSTlh5dCtERE9YL1dOdXBsZmRXLzEzaXRBeUwxMHF6dEVmVGxVK010Qm9zbkN5L2ROSjNCVXFzUmZXbjE1MWNqRCtkL3NhN25aajE0cXc4dFh5MjExS3c4Z0FMcitLa2lqc09LWC90YlhpMUlqTkV1U2dOOWZNQjk0OFI1VTViM05GbjNRWlRFeGJ3cjE2YlBuTjBtemhVWDRsRUNUOE94ZEw1cTMvM3dEQWFnb0xOd2FIbXdNZEtmNWh0OVhvcGFPU3pUNy9aeHZ2OVNuaGxUMUQ3UFAwL3FxZ2gzVW0vRUdRMWNzbHpZSHllMHlDZFBPSVVhalJ2MjNhMFQwODVnenBoWVZXYXM5Q3N5cFlMTWlWSmtXZUtCN0MrWFRYZjRDUTdPOEZJenl3dkRxdytPeGwvZllSeUoxMXFWQ2tXZVNvZit6RTRKZEpPMU5RNnY0cWxuS1p3TnMwY1BMQ3FJV3Z0MXdhekhiWmhGMzhBU0RLTEcxZmxlN2pFRCtRcFZDTHphM1lDM0xzbVI2YjlJOEl2Wmc0WU1aTkxMM3h2aDdaNGNkWGJrK25NaHhsVFFjT0laaUcwcmhXYWN2dVJDa1kwZXNTNDBTdDhxS1VjY0FUeFIxaFJWQXE3SXRuZXArVGJOcDVBQTg9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * Ge
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Searches\q9yfv_readme_.txt

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .aAEeCbeceB You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! We have also downloaded a lot of private data from your network. If you do not contact as in a 3 days we will post information about your breach on our public news website and after 7 days the whole downloaded info. You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- NTg2LW9ZV1pWTlNwanlKWDZYUVBITVZTLzE2QWNPMXNwWXI1Mmx4L2haeHprZm9GNmt6ODIxS3hIY1B6QThFdS90ZFhWSHpGQnd3Q2pqU1BHaUxja2RJU2xtNmVaK2NHWU5qNTBkOVhXNU5vaS9KT0lNcFNiWVNkNW1Kb0Yvd2QyVDlNdk83NVQrWlBEMWtNdjlTTlcvS0NZZEFLZUdTVzEvTlNSNWdEcDdKQlRnQldJRFN6Z3RkOXBNVjZjTjU5ejhCZUpraXpSbEVuSnJoVlNUYjU5eGV5blZINlNWOUkrdkFFeGR5MFZiZGVXY09nQklqUVZBRVh0QkRSS0t0bHNYWTZOMlZpUGE4cW84dkJ0c2hvclB6RlNZc1c1clhKRmUxaFBtWVRLVUNDZThjeGR0Y2VSOWo1ZkF3UVYrdE5ta0tRREhyNS9HWFgzNHdUaXFsRkFuYy9JdjlaNlJqeEVaMG9kVndFMGFQd2FHZkluVmhTbnpZemtGajkwcjFjeVVoZFBPQmV0Y3RUdEdFZUJxaFFHR0c5V1lES3JNaVZmeDIvNTY4RGtFMWxDUFNSaUZkY2JZZ0E2aFpQUTlBY20zRXpUbk1PTm9CRGtrTkRRTWszUnFYNENwVkhsN2VCYzkzOE1VWG9JMUVwWkdScWxTSEV2blZqKyt6cU5nYm1XUU9ER0hDdTBWN0FRUEtNZUNHeEp6ZkQwNDNNVHdZRjhwT2tIem1qQUxEYzRQQ0tnQlkrSGJGNTFUZ3hCOTRFbXkxbDRLRkdOaHkzRVhPTnVZRkdrN2xDLzFGUFVnZHB5MlgzSkxhdXovckYrUGVIYklLTEV6MlF5MU14eDJzVnN6MGgrWDlYMDlVdGQzSkFKdDlMT2JiaG9iL3hUei84ZVVHNTVWbDRuSjRWT3d0MFJ0OXpybTNPYS9iaXhlYXZCQ1JFYXluNkpnazR1YjlLeGI4NnVWOEk2TnVrWGh5ZGRCdUhJZUR2QnBQd21ERExkTFFSS2s3TVhiOFE1T1BEeGFUR1JoSERVSXM5cHRiOUt3QVdwT2RyUThhMFlESGdzbk0vdHZ3RUwzby9SS0JjMHlITFh4eGtFbFROT1k1Z2h6V3EvNmh6MUtneE5ONGNjUmNTc0JnYjc5TDh3TWM3bHVoS0UvMGRrY01TdUVkc0FLR1ZTSUtaaUN4SjY1YVFWUHFXZE9PR1ZSUFJqYWhPWmVQMHFTaU1WNUM0TjZzaHVHL1F0WlZSVFRwWWw0SlpMZ2p5bnh6UlFRbzBxN0s1L1FORmZ0QjZDWW1TVHN2U1pPT2JxSG52TU8wY2JTNXNlZndEZFJveUJjREpmQmZhdmhPUnFqazNaQnlBTk9veUVyNmczd25ZcWxoZ3I1TzEzY202Ym1rQTBrQ1FMSHo4b0M0S1RkK0srd1ZxSHFLY1dZa1k0L0htNmxNNkQ1VUd6NWVCTWVSTlh5dCtERE9YL1dOdXBsZmRXLzEzaXRBeUwxMHF6dEVmVGxVK010Qm9zbkN5L2ROSjNCVXFzUmZXbjE1MWNqRCtkL3NhN25aajE0cXc4dFh5MjExS3c4Z0FMcitLa2lqc09LWC90YlhpMUlqTkV1U2dOOWZNQjk0OFI1VTViM05GbjNRWlRFeGJ3cjE2YlBuTjBtemhVWDRsRUNUOE94ZEw1cTMvM3dEQWFnb0xOd2FIbXdNZEtmNWh0OVhvcGFPU3pUNy9aeHZ2OVNuaGxUMUQ3UFAwL3FxZ2gzVW0vRUdRMWNzbHpZSHllMHlDZFBPSVVhalJ2MjNhMFQwODVnenBoWVZXYXM5Q3N5cFlMTWlWSmtXZUtCN0MrWFRYZjRDUTdPOEZJenl3dkRxdytPeGwvZllSeUoxMXFWQ2tXZVNvZit6RTRKZEpPMU5RNnY0cWxuS1p3TnMwY1BMQ3FJV3Z0MXdhekhiWmhGMzhBU0RLTEcxZmxlN2pFRCtRcFZDTHphM1lDM0xzbVI2YjlJOEl2Wmc0WU1aTkxMM3h2aDdaNGNkWGJrK25NaHhsVFFjT0laaUcwcmhXYWN2dVJDa1kwZXNTNDBTdDhxS1VjY0FUeFIxaFJWQXE3SXRuZXArVGJOcDVBQTg9 -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * cm1S5G
URLs

http://avaddonbotrxmuyl.onion

Targets

    • Target

      6c68f61ddd1c17b8bef5080ee8b113ebaa90c415a11a137f74a73429fb79877d

    • Size

      714KB

    • MD5

      c497f83e28e9f3a7fdebc64ab1a1ea23

    • SHA1

      4eee6846c84fb3eb1b73ca085a9ee016aa0bedb9

    • SHA256

      6c68f61ddd1c17b8bef5080ee8b113ebaa90c415a11a137f74a73429fb79877d

    • SHA512

      b761e1e9de8e2a1ad43ef86b3adf0839bdda26f02edcd7aaf701cbf930c38d8a9381794f6e2edc6959ef1ce23a23d3b68640c737ab817a03d533db1e3004dd42

    • Avaddon

      Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

    • Avaddon Ransomware

    • UAC bypass

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks