General
-
Target
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.zip
-
Size
485KB
-
Sample
230311-tcknksad36
-
MD5
a071fce53e2bf9fb9a2db5ce91c511ef
-
SHA1
addf8230e78fa84c8b9c1b3bac4162a82e6421b4
-
SHA256
7662313c95bb2e2cc6a34343d7375903bf079641a07886fc01c1547f198c1c04
-
SHA512
636e1382cccd782d594f4cc0dcf9d40fe34d0d1f6b2033c7395b665adda86a4f7f6ef6fca46da562982f0dc7480b1f8291dedd2a55b177c33ed171452ac47d00
-
SSDEEP
12288:1ALp9O2llZPJPgekZm+vCLHugohggZLCMGxyx:WrOklZPZgDm+vCLHuOgZLCJS
Behavioral task
behavioral1
Sample
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\385708-readme.html
avaddon
Targets
-
-
Target
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269.exe
-
Size
1.1MB
-
MD5
dea3cd30c30338a50368cf65f7ff5f1f
-
SHA1
ce678c542226ef7099fa74a74cd2a664e4bec841
-
SHA256
0f081ea4e30ca05fc2977235bf239992b17fa9968b58b001990e4539f0899269
-
SHA512
4fc2dd833ef4e0251976a083b8d3e52732fb792c2a467f401be82c952354daef7b1aca84da1fc2a99bc52a4b3f5372799545eeb29c775b42d32a57f20e65c3a3
-
SSDEEP
24576:Y/M3X2S1dvOtYJx3n5r020E5BeGx/qrzmj1LNU5DECibbbbpcu:YC2SjTJx3n5r02V5UfzmpLIYbbbbpcu
Score10/10-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Avaddon payload
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-