General
-
Target
c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.zip
-
Size
199KB
-
Sample
231119-1cntkabh28
-
MD5
1aa59eb82919d93a8b6aa4e092b03cf7
-
SHA1
00ccd339b7d6b7656c5eb176084861e1cf069e8e
-
SHA256
179337cf07980e59c19de05d633458ec2659128eddf51076a80fb06db675e0aa
-
SHA512
8b8b409ca5ebc566aa9b1ae320efe425528f6dcc6826540ddc594a4bf0c5c1b50340b5c9c40d3ab3dd9e56742dbaf50f8f92e26e76403142cfbac1ce239b33a5
-
SSDEEP
6144:3yhh8ysUbYLu6mMnxuCpxGS3PDHsqnMv/DyG423wmFxJQkOgT:Ch2ysUudmMxR/DPDMqn9G4235xJQktT
Behavioral task
behavioral1
Sample
c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
Resource
win10v2004-20231023-en
Malware Config
Extracted
C:\Users\Admin\Desktop\6IvOq_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Downloads\6IvOq_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\6IvOq_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Desktop\gfFxq_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Desktop\gfFxq_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Pictures\gfFxq_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Targets
-
-
Target
c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
-
Size
483KB
-
MD5
53717dc73f61b0f9551cb62d6fca2e4a
-
SHA1
1ca9304e86632b147852767c85c57e08bdfc8855
-
SHA256
c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028
-
SHA512
ae6ff8377d89cd3d1686c5a6bd7bb398bb975e4e52f7db5fbb0550783d77648558f03a13a9751d0cb6ed993621b12980d54777385802dd4c014ec22ae8d33552
-
SSDEEP
12288:WcvbX8rMmSZJ8t9ZITyDpFGIOyA4muT5WFExk8y:/zMr1SZJ8t9ZITyNzOt4dVy
Score10/10-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Renames multiple (164) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Renames multiple (173) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-