General

  • Target

    e24f69aa8738d14b85ad76a1783d51120b8b6ba467190fe7d8f96ad2969c8fdf.zip

  • Size

    2.0MB

  • Sample

    240402-mn9zaafg74

  • MD5

    5ca7517a95cd5124bd07a883f0aef3db

  • SHA1

    bd2a4e773949c11ca98a4c00bea43d805f9db930

  • SHA256

    e86da4f9fcfcee747b03ed15d6b091911e34c2477472b38cd33b95735da179f8

  • SHA512

    a36b58aa2d195ace0154c39257dbb402a046a76925437a4012339476eba5cca21ab1804b55afe49e5153d7215efc7a3cac46caf136cd4bc46bc4e237b66fa077

  • SSDEEP

    49152:TPfXQ8e7k+mh2fQNLcg5moXD2rf4+WwffS/MFcYb7h7n0KNO:TXXJN+QpcgH2jgwf+9Y/tnK

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\a1lUSTTD_readme.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .aeAbCBCCaB You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- Mzk5LTRNYkl1ay9HM0JCbVRCbkR1WUgwK29yYkdORlkvVjlYMDYzOUU2bHcwUWVQOEtpdFFyUVRsVlBKbXdVVFA4ZVp0bDBJdjAzVjlPTGxtMElNNEN4bU8vZW90QTBMOTJoN0NLSEh3dHM3UHhBaVpFWjczdElyT3U1RlRTMk5oU0FqblZ6eEtFUzNIN0o5VVI2M2pPdlpqcDJYM04wVDRDbmlEbkYyckZxcVdmVzJ3N01UVmowUENLVTN3M2xzdUNIR2ZGcjdQclMrRGpJNUd5bm9iUU9INm5HY3dyVFpzMjlHWTRISDk0RGtIZVMvQmZwRWd0dGxUbDBsT1hNZy9PT1BGVllFWWs5eFhHOFJLYnN4RFRRRVFqVGE3YTJwcjFUUWlQblN6OXVVWUJWYW1IVmlKZ3hKWUhRbkluaDMrWW9SVXlOMHJRVlU3ZXJ2WGUvQnlwbDE1WDAwT1dRTUc2NEtJdDNHTHFsTENuTUprNU9ubmhZSDNMSlprU1VNMi9OU1dRYm9uOUlOWERXcWRLaGV5NXp2T2krcDhwT2xTKzZiSkpJWjV0QVZNQzFVazN2a2h6MTU3WEZBck5ObFBCYXpNc01TSEZQS0FpWHpaTTl2TW5LbCtJa1Qya1p2bGRoNWZrM0c2Qmd3MVBRRFFVNEJxRkljSTdKVFVyTE9sc3ZBZlZTNEVjUlE2bEJvdk5jbE5wWU05TTJwZnRZbVpPb0VKbHhjUUYvbCswNXB3NHpncHVFY1Z6VHBHSmlRMmVzdU1IMFF4QUdnTzl3MURPUDZYaDVMK0NjQjN4ck5USkRGd25IU2UydXUzcDR0T3g1UGlmYVg3V0lIbytkNnhUak1Ja1FxMUcxUWVqdGxiUVFRNzNGMXFIREZ4TFBnYjRwU1FmZ0xsRnlrZFdSYVdEODdBOUREcHRxbTY2RXNxaWVkQklOU2hLNmlEWFU3MEFTbWFrZUFvblkyQzkxa1ZpWWJRbGt2UDRvR2FjaHRWZXJMdVZBSWp6d2wvMHg0VVVQUlNpbEpzUE1vNHM0WG5QNXFiT1QrWnpjSG42eVAvSWhTNyt1S0h6TFpMVEdZQzV6L2NFbFU1cjBJQ014RGtaMTQ1bEFBTm5kcTBFQXNvMHFGY2QyblM3cFFoUzJNemhid3NWSG4zVXgyYU81RURRUjN2VXdWb3poTGVidEVuSi9XWHJqVHhJKzlwSWwvSlNTMnk3T2Y3MVovSDJIWkpPallqR3IvTGtuR0lZTW92YVp1SFkvS1FjOXdpb20wRXd1SkEwb21FeW9HK2p5TmxDY2JqZlJjQ1ZiUWh6UjhKSFhjSUQ0YmhpVU16RFl6MEZaOHQxUExMTFJieU92U2pRMExSQWNka29IL050UnBRNi9KazZlMnhSVDJxem5iWEVTbG5BbXM2M0EzTVlmS1dTRVZFcFdsY1Y2N013YUhHTHp4aVYrVSsxR0xSSEVqTFFvR3dmZ001MGZiU0hnSW5EYmVkSmdzbTNjZlkzVGtVdWJOa3NNWXpzQTA0ZnhFV3B4Y1pSd21yR0MzRzNkS3RaMTlzano5UENZaElINzdGL2NXVytFVXhPeFRCMC9rMEp3VWNaRUxkVy9rYVhxZ1B4anc1UEQrUjJ1NWZxU2Q1NmlzUzZPZ2lpbnc3b3YyalBMRU1DVERXejdoNTBRK1N6L1dLRXZhR3RCc0Q3K3Z1MzhFSlF2cVhVLzFWVkNmN09waFBGQzNnNWZ0V3J0bUJKVk9mREU2cWo3eDQ0ZHpQVm5GUHVqT2UyK3NLVGpYR3dwQnhRYUZSalFvblJaL3VGaXlzNE5rK2VjaVNWcHlFcW5oVjluZEsrMTA2Y3RxaEdMNDBsYXZxQWlKTDVJSjhuamNncmxaTnFTQ1hpbzYxWnRsSVFoNlVRRG1iUVlhWDA5QzRRWEpkeldYS2VLRzM2aUo3SnIyL3ZheW5MeEVKaTR4dHhrMWdTbFZvYTh1a2t6SXp1ZmpSTmh0dDVYUGtNeTdiZFNzOG9tdkFoMFF6Wk1TM1ZDVHNZMldhbktmNjUyWVNOWER3RWI0OXVJbGNBUU5PSjNLR0RyWGtWckpvWnpOZkZoRmg0cU5HaUlYYWpYWkxTb0pQdzc5K1VObkZkVVJwenVlYytsakNUak1CYXErK1YyYkJ1WGZYSzFUbW9mWW92cHE3SzBGZ1drc04yR3JtUVdjYXpDdGdoTnpLeWNJ -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * V0gRnk8Rv6hjy
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Desktop\a1lUSTTD_readme.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .aeAbCBCCaB You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- Mzk5LTRNYkl1ay9HM0JCbVRCbkR1WUgwK29yYkdORlkvVjlYMDYzOUU2bHcwUWVQOEtpdFFyUVRsVlBKbXdVVFA4ZVp0bDBJdjAzVjlPTGxtMElNNEN4bU8vZW90QTBMOTJoN0NLSEh3dHM3UHhBaVpFWjczdElyT3U1RlRTMk5oU0FqblZ6eEtFUzNIN0o5VVI2M2pPdlpqcDJYM04wVDRDbmlEbkYyckZxcVdmVzJ3N01UVmowUENLVTN3M2xzdUNIR2ZGcjdQclMrRGpJNUd5bm9iUU9INm5HY3dyVFpzMjlHWTRISDk0RGtIZVMvQmZwRWd0dGxUbDBsT1hNZy9PT1BGVllFWWs5eFhHOFJLYnN4RFRRRVFqVGE3YTJwcjFUUWlQblN6OXVVWUJWYW1IVmlKZ3hKWUhRbkluaDMrWW9SVXlOMHJRVlU3ZXJ2WGUvQnlwbDE1WDAwT1dRTUc2NEtJdDNHTHFsTENuTUprNU9ubmhZSDNMSlprU1VNMi9OU1dRYm9uOUlOWERXcWRLaGV5NXp2T2krcDhwT2xTKzZiSkpJWjV0QVZNQzFVazN2a2h6MTU3WEZBck5ObFBCYXpNc01TSEZQS0FpWHpaTTl2TW5LbCtJa1Qya1p2bGRoNWZrM0c2Qmd3MVBRRFFVNEJxRkljSTdKVFVyTE9sc3ZBZlZTNEVjUlE2bEJvdk5jbE5wWU05TTJwZnRZbVpPb0VKbHhjUUYvbCswNXB3NHpncHVFY1Z6VHBHSmlRMmVzdU1IMFF4QUdnTzl3MURPUDZYaDVMK0NjQjN4ck5USkRGd25IU2UydXUzcDR0T3g1UGlmYVg3V0lIbytkNnhUak1Ja1FxMUcxUWVqdGxiUVFRNzNGMXFIREZ4TFBnYjRwU1FmZ0xsRnlrZFdSYVdEODdBOUREcHRxbTY2RXNxaWVkQklOU2hLNmlEWFU3MEFTbWFrZUFvblkyQzkxa1ZpWWJRbGt2UDRvR2FjaHRWZXJMdVZBSWp6d2wvMHg0VVVQUlNpbEpzUE1vNHM0WG5QNXFiT1QrWnpjSG42eVAvSWhTNyt1S0h6TFpMVEdZQzV6L2NFbFU1cjBJQ014RGtaMTQ1bEFBTm5kcTBFQXNvMHFGY2QyblM3cFFoUzJNemhid3NWSG4zVXgyYU81RURRUjN2VXdWb3poTGVidEVuSi9XWHJqVHhJKzlwSWwvSlNTMnk3T2Y3MVovSDJIWkpPallqR3IvTGtuR0lZTW92YVp1SFkvS1FjOXdpb20wRXd1SkEwb21FeW9HK2p5TmxDY2JqZlJjQ1ZiUWh6UjhKSFhjSUQ0YmhpVU16RFl6MEZaOHQxUExMTFJieU92U2pRMExSQWNka29IL050UnBRNi9KazZlMnhSVDJxem5iWEVTbG5BbXM2M0EzTVlmS1dTRVZFcFdsY1Y2N013YUhHTHp4aVYrVSsxR0xSSEVqTFFvR3dmZ001MGZiU0hnSW5EYmVkSmdzbTNjZlkzVGtVdWJOa3NNWXpzQTA0ZnhFV3B4Y1pSd21yR0MzRzNkS3RaMTlzano5UENZaElINzdGL2NXVytFVXhPeFRCMC9rMEp3VWNaRUxkVy9rYVhxZ1B4anc1UEQrUjJ1NWZxU2Q1NmlzUzZPZ2lpbnc3b3YyalBMRU1DVERXejdoNTBRK1N6L1dLRXZhR3RCc0Q3K3Z1MzhFSlF2cVhVLzFWVkNmN09waFBGQzNnNWZ0V3J0bUJKVk9mREU2cWo3eDQ0ZHpQVm5GUHVqT2UyK3NLVGpYR3dwQnhRYUZSalFvblJaL3VGaXlzNE5rK2VjaVNWcHlFcW5oVjluZEsrMTA2Y3RxaEdMNDBsYXZxQWlKTDVJSjhuamNncmxaTnFTQ1hpbzYxWnRsSVFoNlVRRG1iUVlhWDA5QzRRWEpkeldYS2VLRzM2aUo3SnIyL3ZheW5MeEVKaTR4dHhrMWdTbFZvYTh1a2t6SXp1ZmpSTmh0dDVYUGtNeTdiZFNzOG9tdkFoMFF6Wk1TM1ZDVHNZMldhbktmNjUyWVNOWER3RWI0OXVJbGNBUU5PSjNLR0RyWGtWckpvWnpOZkZoRmg0cU5HaUlYYWpYWkxTb0pQdzc5K1VObkZkVVJwenVlYytsakNUak1CYXErK1YyYkJ1WGZYSzFUbW9mWW92cHE3SzBGZ1drc04yR3JtUVdjYXpDdGdoTnpLeWNJ -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * s8Hn8xvFliPoKFC5
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Favorites\Links\a1lUSTTD_readme.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .aeAbCBCCaB You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- Mzk5LTRNYkl1ay9HM0JCbVRCbkR1WUgwK29yYkdORlkvVjlYMDYzOUU2bHcwUWVQOEtpdFFyUVRsVlBKbXdVVFA4ZVp0bDBJdjAzVjlPTGxtMElNNEN4bU8vZW90QTBMOTJoN0NLSEh3dHM3UHhBaVpFWjczdElyT3U1RlRTMk5oU0FqblZ6eEtFUzNIN0o5VVI2M2pPdlpqcDJYM04wVDRDbmlEbkYyckZxcVdmVzJ3N01UVmowUENLVTN3M2xzdUNIR2ZGcjdQclMrRGpJNUd5bm9iUU9INm5HY3dyVFpzMjlHWTRISDk0RGtIZVMvQmZwRWd0dGxUbDBsT1hNZy9PT1BGVllFWWs5eFhHOFJLYnN4RFRRRVFqVGE3YTJwcjFUUWlQblN6OXVVWUJWYW1IVmlKZ3hKWUhRbkluaDMrWW9SVXlOMHJRVlU3ZXJ2WGUvQnlwbDE1WDAwT1dRTUc2NEtJdDNHTHFsTENuTUprNU9ubmhZSDNMSlprU1VNMi9OU1dRYm9uOUlOWERXcWRLaGV5NXp2T2krcDhwT2xTKzZiSkpJWjV0QVZNQzFVazN2a2h6MTU3WEZBck5ObFBCYXpNc01TSEZQS0FpWHpaTTl2TW5LbCtJa1Qya1p2bGRoNWZrM0c2Qmd3MVBRRFFVNEJxRkljSTdKVFVyTE9sc3ZBZlZTNEVjUlE2bEJvdk5jbE5wWU05TTJwZnRZbVpPb0VKbHhjUUYvbCswNXB3NHpncHVFY1Z6VHBHSmlRMmVzdU1IMFF4QUdnTzl3MURPUDZYaDVMK0NjQjN4ck5USkRGd25IU2UydXUzcDR0T3g1UGlmYVg3V0lIbytkNnhUak1Ja1FxMUcxUWVqdGxiUVFRNzNGMXFIREZ4TFBnYjRwU1FmZ0xsRnlrZFdSYVdEODdBOUREcHRxbTY2RXNxaWVkQklOU2hLNmlEWFU3MEFTbWFrZUFvblkyQzkxa1ZpWWJRbGt2UDRvR2FjaHRWZXJMdVZBSWp6d2wvMHg0VVVQUlNpbEpzUE1vNHM0WG5QNXFiT1QrWnpjSG42eVAvSWhTNyt1S0h6TFpMVEdZQzV6L2NFbFU1cjBJQ014RGtaMTQ1bEFBTm5kcTBFQXNvMHFGY2QyblM3cFFoUzJNemhid3NWSG4zVXgyYU81RURRUjN2VXdWb3poTGVidEVuSi9XWHJqVHhJKzlwSWwvSlNTMnk3T2Y3MVovSDJIWkpPallqR3IvTGtuR0lZTW92YVp1SFkvS1FjOXdpb20wRXd1SkEwb21FeW9HK2p5TmxDY2JqZlJjQ1ZiUWh6UjhKSFhjSUQ0YmhpVU16RFl6MEZaOHQxUExMTFJieU92U2pRMExSQWNka29IL050UnBRNi9KazZlMnhSVDJxem5iWEVTbG5BbXM2M0EzTVlmS1dTRVZFcFdsY1Y2N013YUhHTHp4aVYrVSsxR0xSSEVqTFFvR3dmZ001MGZiU0hnSW5EYmVkSmdzbTNjZlkzVGtVdWJOa3NNWXpzQTA0ZnhFV3B4Y1pSd21yR0MzRzNkS3RaMTlzano5UENZaElINzdGL2NXVytFVXhPeFRCMC9rMEp3VWNaRUxkVy9rYVhxZ1B4anc1UEQrUjJ1NWZxU2Q1NmlzUzZPZ2lpbnc3b3YyalBMRU1DVERXejdoNTBRK1N6L1dLRXZhR3RCc0Q3K3Z1MzhFSlF2cVhVLzFWVkNmN09waFBGQzNnNWZ0V3J0bUJKVk9mREU2cWo3eDQ0ZHpQVm5GUHVqT2UyK3NLVGpYR3dwQnhRYUZSalFvblJaL3VGaXlzNE5rK2VjaVNWcHlFcW5oVjluZEsrMTA2Y3RxaEdMNDBsYXZxQWlKTDVJSjhuamNncmxaTnFTQ1hpbzYxWnRsSVFoNlVRRG1iUVlhWDA5QzRRWEpkeldYS2VLRzM2aUo3SnIyL3ZheW5MeEVKaTR4dHhrMWdTbFZvYTh1a2t6SXp1ZmpSTmh0dDVYUGtNeTdiZFNzOG9tdkFoMFF6Wk1TM1ZDVHNZMldhbktmNjUyWVNOWER3RWI0OXVJbGNBUU5PSjNLR0RyWGtWckpvWnpOZkZoRmg0cU5HaUlYYWpYWkxTb0pQdzc5K1VObkZkVVJwenVlYytsakNUak1CYXErK1YyYkJ1WGZYSzFUbW9mWW92cHE3SzBGZ1drc04yR3JtUVdjYXpDdGdoTnpLeWNJ -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * iktAS9iY7K7NDfq7Yim
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Public\Pictures\Sample Pictures\a1lUSTTD_readme.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .aeAbCBCCaB You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- Mzk5LTRNYkl1ay9HM0JCbVRCbkR1WUgwK29yYkdORlkvVjlYMDYzOUU2bHcwUWVQOEtpdFFyUVRsVlBKbXdVVFA4ZVp0bDBJdjAzVjlPTGxtMElNNEN4bU8vZW90QTBMOTJoN0NLSEh3dHM3UHhBaVpFWjczdElyT3U1RlRTMk5oU0FqblZ6eEtFUzNIN0o5VVI2M2pPdlpqcDJYM04wVDRDbmlEbkYyckZxcVdmVzJ3N01UVmowUENLVTN3M2xzdUNIR2ZGcjdQclMrRGpJNUd5bm9iUU9INm5HY3dyVFpzMjlHWTRISDk0RGtIZVMvQmZwRWd0dGxUbDBsT1hNZy9PT1BGVllFWWs5eFhHOFJLYnN4RFRRRVFqVGE3YTJwcjFUUWlQblN6OXVVWUJWYW1IVmlKZ3hKWUhRbkluaDMrWW9SVXlOMHJRVlU3ZXJ2WGUvQnlwbDE1WDAwT1dRTUc2NEtJdDNHTHFsTENuTUprNU9ubmhZSDNMSlprU1VNMi9OU1dRYm9uOUlOWERXcWRLaGV5NXp2T2krcDhwT2xTKzZiSkpJWjV0QVZNQzFVazN2a2h6MTU3WEZBck5ObFBCYXpNc01TSEZQS0FpWHpaTTl2TW5LbCtJa1Qya1p2bGRoNWZrM0c2Qmd3MVBRRFFVNEJxRkljSTdKVFVyTE9sc3ZBZlZTNEVjUlE2bEJvdk5jbE5wWU05TTJwZnRZbVpPb0VKbHhjUUYvbCswNXB3NHpncHVFY1Z6VHBHSmlRMmVzdU1IMFF4QUdnTzl3MURPUDZYaDVMK0NjQjN4ck5USkRGd25IU2UydXUzcDR0T3g1UGlmYVg3V0lIbytkNnhUak1Ja1FxMUcxUWVqdGxiUVFRNzNGMXFIREZ4TFBnYjRwU1FmZ0xsRnlrZFdSYVdEODdBOUREcHRxbTY2RXNxaWVkQklOU2hLNmlEWFU3MEFTbWFrZUFvblkyQzkxa1ZpWWJRbGt2UDRvR2FjaHRWZXJMdVZBSWp6d2wvMHg0VVVQUlNpbEpzUE1vNHM0WG5QNXFiT1QrWnpjSG42eVAvSWhTNyt1S0h6TFpMVEdZQzV6L2NFbFU1cjBJQ014RGtaMTQ1bEFBTm5kcTBFQXNvMHFGY2QyblM3cFFoUzJNemhid3NWSG4zVXgyYU81RURRUjN2VXdWb3poTGVidEVuSi9XWHJqVHhJKzlwSWwvSlNTMnk3T2Y3MVovSDJIWkpPallqR3IvTGtuR0lZTW92YVp1SFkvS1FjOXdpb20wRXd1SkEwb21FeW9HK2p5TmxDY2JqZlJjQ1ZiUWh6UjhKSFhjSUQ0YmhpVU16RFl6MEZaOHQxUExMTFJieU92U2pRMExSQWNka29IL050UnBRNi9KazZlMnhSVDJxem5iWEVTbG5BbXM2M0EzTVlmS1dTRVZFcFdsY1Y2N013YUhHTHp4aVYrVSsxR0xSSEVqTFFvR3dmZ001MGZiU0hnSW5EYmVkSmdzbTNjZlkzVGtVdWJOa3NNWXpzQTA0ZnhFV3B4Y1pSd21yR0MzRzNkS3RaMTlzano5UENZaElINzdGL2NXVytFVXhPeFRCMC9rMEp3VWNaRUxkVy9rYVhxZ1B4anc1UEQrUjJ1NWZxU2Q1NmlzUzZPZ2lpbnc3b3YyalBMRU1DVERXejdoNTBRK1N6L1dLRXZhR3RCc0Q3K3Z1MzhFSlF2cVhVLzFWVkNmN09waFBGQzNnNWZ0V3J0bUJKVk9mREU2cWo3eDQ0ZHpQVm5GUHVqT2UyK3NLVGpYR3dwQnhRYUZSalFvblJaL3VGaXlzNE5rK2VjaVNWcHlFcW5oVjluZEsrMTA2Y3RxaEdMNDBsYXZxQWlKTDVJSjhuamNncmxaTnFTQ1hpbzYxWnRsSVFoNlVRRG1iUVlhWDA5QzRRWEpkeldYS2VLRzM2aUo3SnIyL3ZheW5MeEVKaTR4dHhrMWdTbFZvYTh1a2t6SXp1ZmpSTmh0dDVYUGtNeTdiZFNzOG9tdkFoMFF6Wk1TM1ZDVHNZMldhbktmNjUyWVNOWER3RWI0OXVJbGNBUU5PSjNLR0RyWGtWckpvWnpOZkZoRmg0cU5HaUlYYWpYWkxTb0pQdzc5K1VObkZkVVJwenVlYytsakNUak1CYXErK1YyYkJ1WGZYSzFUbW9mWW92cHE3SzBGZ1drc04yR3JtUVdjYXpDdGdoTnpLeWNJ -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * 4sU1nMUMwxpwZ5z9jFhGRaD
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Desktop\9OZaS_readme.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bAaDbBbDcE You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- Mzk5LTlRUS9wWjkrUnduaW16My9wTU9ydTBjMnByS0NkTSt0ZkxmbUVRUEJhdXZ1NDhiSkJ0SndtdUExQ3pzY05YYnFBK0h3NEtCU09mcjlzZWpDcEViMTlVMTNCc0xGVm5GU3lnS05Pano0WDE3VGFweFV6dXczcHQ3QTAwTmY3dXlKeTg3UytWT1g4OTR6NDJaYmtSOHpJUE04Zks5RnpVZGJGZ1V6TDJRMzlBdDN4Y2p3K2FYUU96T2FXamdYbFpKZWtrMUNMUHhZRE9lMlJXbG9tcUMrZFBKcHFOcjUvRUplUWNGcEN0aGdDQ3lCb3hxZWE2b0tYVWwrZGRQQkVhbWdXL21IbXRjZ0FDdU1HS3NyS3Jjc2s1RkMvYVpEaUVORUdKbEtFR3QyVDZ0bzVkcmx4Mm9tRWUxWXNkSzlZVEVWNzByT0Yxa2pLWDV6bE0wSk8yVCthZFBhN003cGtTYzBkS05nQjNvMWNLZGVRY2lTN2tKTWlQbHh6My9jdy9ZZVF2M25mRHBBLytITldNeHRYNkdmU2U3WTVXVjcyQlB6Q3RaWDAzRWYrZ3ZCVnhLdU9vUW5CMmZtZ0p1NDRCcWVpc1VtTUxzVW9VN25WQnM3ZkNtWEVUcC93NmxzVUlEMDc3ZzExZjZzWEVFZzR5SGZWY0t5Qjl4V1c4T01lUndvUmZJS0xKZlNCRVRQTU5NWXFFRFhOWEJoTmgraTVZTHdZWUtEM3hMVEZUcTBYRkxGc3VHb0FMM2o4cHRxVk53TUJLT0dtU052cy9FclpURWRZQmJyVlVqRlZDTnNFOHBxWnNkNy91U1R1S016WE9GTURvU0Nyby9qbERmdktGM0hKamdzd3dIUGFCYmhDM0txNWJBS2U3S3d3WjJCYmRyK284YjdkbGlpVGJyQWZxTTBaM0lEUUlGWUVKNlB4VVU3NHFxYml2eE9Pd3pLYUxiUHh6NkZueG04ZFZxYm5kWjdSN3UwazJHK1Bwa2VOTWVWaER6VHpMZUF5NUZSeUxuZ3VRZnZMallWVjVHaTgybTVGOUxYWXNGOVJlQlNNVEFkR3FJUzVoNXk1R0xPQmZvWGRxWlZKdDNzT0NuREx1V0lZOXFRaXk0TEJxNzJOUTJJdFRYd1FvdEhDYTBXRWtTeEV4djRtQnY3NVV6VVpsZHR0SXdVT0pqZU9BbDVEdnVPdldlUENqNWk1dmhyd3NvNXZEVEtHV09kSElZcFdwT3FuSTdjcVQzY05tSDlCQ25yb3ZtNE5pRTBiUHNoWlJ1UnhHMUZ4eEtHWWpHMkRJLzNuUk5tcGdwam0yQVJkRnRuMHNib3dNSlpGQ2tTekg1Z0JaQTlQbW1rWWpjajNtOGY0UW0xU0crOHcwdzdkY1VNaWdxVmR0bXpjTHNFMjJLZlBmVkRsZ0dVZDBxSkV5ZTRqT01EcmNhZC9iMkgyOU40bVVFbThTS1dDRHRnU0ZtQU9KblhCUFRrUE1HMzlMNWo4MUFkeSttdCtNVU11YkF1Q2t1TXhIUUpIZFdaSVduSklPZTNLcDhaRHo5c1dnb2JkL05oZEY0MXNyUWxhUitWbHdGZzZmRW15TUROd1c4bk5UZFlVZW9oNStkWnI5K3dXVTVZTU80TzF4NFBQK3l5M2QxRytaMW4wMVpQbjkwNUQwOFN2dG5pdmVjYWc1Q0VQZ05uc09TRzV1TEV3VW45ODJnd3R2SU45WnBwejRlcjVaR0RkSXlpR0xsVmhmRUZwMFBDMHd0ZkdzeUx6bzROdU1aWGc2R0N2SDNGckduNjhKQjg4a2NXaFQ3N2NOaTdETEo3bXZQVng5SmZaMVVtR2FBMmE1MmZRU0VyeVp4SThaRnRYM0E2Y2NLdVZ1MmlsY2pVeDJpUEl6cU5yNmh5ejdzc2ZNSGtsS3pqL3FXN1Bjck1yRHo5d2R6MHc0aUIyU2hGYkhVc2pIWE5DcTBWSGlTN0Z6L1FmNGFUamZZMEFmRVJOUlU2QVg1MTFIL2hKVUUrZ0lHbldUMFkrVWFreDNXMHFKTzJuVHhqVnJEc3FuWEVvSklYWVY0cUlsUjV4dkpydTk1N2cwem82WVFLTklGQUI1bVZnTEVYbERnWVpoVG10dHFZTUdwZWgxYlNKb1NpaHcra016c0pwMUc1VkVidkxrZG1oSFpZYXdrbjN6eWViZlVySVYvZDlHSElpQTk1UHBxSlB2dFFBUnpq -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * 4sU1nMUMwxpwZ5z9jFhGRaD
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Downloads\9OZaS_readme.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bAaDbBbDcE You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- Mzk5LTlRUS9wWjkrUnduaW16My9wTU9ydTBjMnByS0NkTSt0ZkxmbUVRUEJhdXZ1NDhiSkJ0SndtdUExQ3pzY05YYnFBK0h3NEtCU09mcjlzZWpDcEViMTlVMTNCc0xGVm5GU3lnS05Pano0WDE3VGFweFV6dXczcHQ3QTAwTmY3dXlKeTg3UytWT1g4OTR6NDJaYmtSOHpJUE04Zks5RnpVZGJGZ1V6TDJRMzlBdDN4Y2p3K2FYUU96T2FXamdYbFpKZWtrMUNMUHhZRE9lMlJXbG9tcUMrZFBKcHFOcjUvRUplUWNGcEN0aGdDQ3lCb3hxZWE2b0tYVWwrZGRQQkVhbWdXL21IbXRjZ0FDdU1HS3NyS3Jjc2s1RkMvYVpEaUVORUdKbEtFR3QyVDZ0bzVkcmx4Mm9tRWUxWXNkSzlZVEVWNzByT0Yxa2pLWDV6bE0wSk8yVCthZFBhN003cGtTYzBkS05nQjNvMWNLZGVRY2lTN2tKTWlQbHh6My9jdy9ZZVF2M25mRHBBLytITldNeHRYNkdmU2U3WTVXVjcyQlB6Q3RaWDAzRWYrZ3ZCVnhLdU9vUW5CMmZtZ0p1NDRCcWVpc1VtTUxzVW9VN25WQnM3ZkNtWEVUcC93NmxzVUlEMDc3ZzExZjZzWEVFZzR5SGZWY0t5Qjl4V1c4T01lUndvUmZJS0xKZlNCRVRQTU5NWXFFRFhOWEJoTmgraTVZTHdZWUtEM3hMVEZUcTBYRkxGc3VHb0FMM2o4cHRxVk53TUJLT0dtU052cy9FclpURWRZQmJyVlVqRlZDTnNFOHBxWnNkNy91U1R1S016WE9GTURvU0Nyby9qbERmdktGM0hKamdzd3dIUGFCYmhDM0txNWJBS2U3S3d3WjJCYmRyK284YjdkbGlpVGJyQWZxTTBaM0lEUUlGWUVKNlB4VVU3NHFxYml2eE9Pd3pLYUxiUHh6NkZueG04ZFZxYm5kWjdSN3UwazJHK1Bwa2VOTWVWaER6VHpMZUF5NUZSeUxuZ3VRZnZMallWVjVHaTgybTVGOUxYWXNGOVJlQlNNVEFkR3FJUzVoNXk1R0xPQmZvWGRxWlZKdDNzT0NuREx1V0lZOXFRaXk0TEJxNzJOUTJJdFRYd1FvdEhDYTBXRWtTeEV4djRtQnY3NVV6VVpsZHR0SXdVT0pqZU9BbDVEdnVPdldlUENqNWk1dmhyd3NvNXZEVEtHV09kSElZcFdwT3FuSTdjcVQzY05tSDlCQ25yb3ZtNE5pRTBiUHNoWlJ1UnhHMUZ4eEtHWWpHMkRJLzNuUk5tcGdwam0yQVJkRnRuMHNib3dNSlpGQ2tTekg1Z0JaQTlQbW1rWWpjajNtOGY0UW0xU0crOHcwdzdkY1VNaWdxVmR0bXpjTHNFMjJLZlBmVkRsZ0dVZDBxSkV5ZTRqT01EcmNhZC9iMkgyOU40bVVFbThTS1dDRHRnU0ZtQU9KblhCUFRrUE1HMzlMNWo4MUFkeSttdCtNVU11YkF1Q2t1TXhIUUpIZFdaSVduSklPZTNLcDhaRHo5c1dnb2JkL05oZEY0MXNyUWxhUitWbHdGZzZmRW15TUROd1c4bk5UZFlVZW9oNStkWnI5K3dXVTVZTU80TzF4NFBQK3l5M2QxRytaMW4wMVpQbjkwNUQwOFN2dG5pdmVjYWc1Q0VQZ05uc09TRzV1TEV3VW45ODJnd3R2SU45WnBwejRlcjVaR0RkSXlpR0xsVmhmRUZwMFBDMHd0ZkdzeUx6bzROdU1aWGc2R0N2SDNGckduNjhKQjg4a2NXaFQ3N2NOaTdETEo3bXZQVng5SmZaMVVtR2FBMmE1MmZRU0VyeVp4SThaRnRYM0E2Y2NLdVZ1MmlsY2pVeDJpUEl6cU5yNmh5ejdzc2ZNSGtsS3pqL3FXN1Bjck1yRHo5d2R6MHc0aUIyU2hGYkhVc2pIWE5DcTBWSGlTN0Z6L1FmNGFUamZZMEFmRVJOUlU2QVg1MTFIL2hKVUUrZ0lHbldUMFkrVWFreDNXMHFKTzJuVHhqVnJEc3FuWEVvSklYWVY0cUlsUjV4dkpydTk1N2cwem82WVFLTklGQUI1bVZnTEVYbERnWVpoVG10dHFZTUdwZWgxYlNKb1NpaHcra016c0pwMUc1VkVidkxrZG1oSFpZYXdrbjN6eWViZlVySVYvZDlHSElpQTk1UHBxSlB2dFFBUnpq -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * RVbNcYHfmZX1v1dBPlcscFLWTq
URLs

http://avaddonbotrxmuyl.onion

Extracted

Path

C:\Users\Admin\Pictures\9OZaS_readme.txt

Family

avaddon

Ransom Note
-------=== Your network has been infected! ===------- ***************** DO NOT DELETE THIS FILE UNTIL ALL YOUR DATA HAVE BEEN RECOVERED ***************** All your documents, photos, databases and other important files have been encrypted and have the extension: .bAaDbBbDcE You are not able to decrypt it by yourself. But don't worry, we can help you to restore all your files! The only way to restore your files is to buy our special software. Only we can give you this software and only we can restore your files! You can get more information on our page, which is located in a Tor hidden network. How to get to our page -------------------------------------------------------------------------------- | | 1. Download Tor browser - https://www.torproject.org/ | | 2. Install Tor browser | | 3. Open link in Tor browser - avaddonbotrxmuyl.onion | | 4. Follow the instructions on this page | -------------------------------------------------------------------------------- Your ID: -------------------------------------------------------------------------------- Mzk5LTlRUS9wWjkrUnduaW16My9wTU9ydTBjMnByS0NkTSt0ZkxmbUVRUEJhdXZ1NDhiSkJ0SndtdUExQ3pzY05YYnFBK0h3NEtCU09mcjlzZWpDcEViMTlVMTNCc0xGVm5GU3lnS05Pano0WDE3VGFweFV6dXczcHQ3QTAwTmY3dXlKeTg3UytWT1g4OTR6NDJaYmtSOHpJUE04Zks5RnpVZGJGZ1V6TDJRMzlBdDN4Y2p3K2FYUU96T2FXamdYbFpKZWtrMUNMUHhZRE9lMlJXbG9tcUMrZFBKcHFOcjUvRUplUWNGcEN0aGdDQ3lCb3hxZWE2b0tYVWwrZGRQQkVhbWdXL21IbXRjZ0FDdU1HS3NyS3Jjc2s1RkMvYVpEaUVORUdKbEtFR3QyVDZ0bzVkcmx4Mm9tRWUxWXNkSzlZVEVWNzByT0Yxa2pLWDV6bE0wSk8yVCthZFBhN003cGtTYzBkS05nQjNvMWNLZGVRY2lTN2tKTWlQbHh6My9jdy9ZZVF2M25mRHBBLytITldNeHRYNkdmU2U3WTVXVjcyQlB6Q3RaWDAzRWYrZ3ZCVnhLdU9vUW5CMmZtZ0p1NDRCcWVpc1VtTUxzVW9VN25WQnM3ZkNtWEVUcC93NmxzVUlEMDc3ZzExZjZzWEVFZzR5SGZWY0t5Qjl4V1c4T01lUndvUmZJS0xKZlNCRVRQTU5NWXFFRFhOWEJoTmgraTVZTHdZWUtEM3hMVEZUcTBYRkxGc3VHb0FMM2o4cHRxVk53TUJLT0dtU052cy9FclpURWRZQmJyVlVqRlZDTnNFOHBxWnNkNy91U1R1S016WE9GTURvU0Nyby9qbERmdktGM0hKamdzd3dIUGFCYmhDM0txNWJBS2U3S3d3WjJCYmRyK284YjdkbGlpVGJyQWZxTTBaM0lEUUlGWUVKNlB4VVU3NHFxYml2eE9Pd3pLYUxiUHh6NkZueG04ZFZxYm5kWjdSN3UwazJHK1Bwa2VOTWVWaER6VHpMZUF5NUZSeUxuZ3VRZnZMallWVjVHaTgybTVGOUxYWXNGOVJlQlNNVEFkR3FJUzVoNXk1R0xPQmZvWGRxWlZKdDNzT0NuREx1V0lZOXFRaXk0TEJxNzJOUTJJdFRYd1FvdEhDYTBXRWtTeEV4djRtQnY3NVV6VVpsZHR0SXdVT0pqZU9BbDVEdnVPdldlUENqNWk1dmhyd3NvNXZEVEtHV09kSElZcFdwT3FuSTdjcVQzY05tSDlCQ25yb3ZtNE5pRTBiUHNoWlJ1UnhHMUZ4eEtHWWpHMkRJLzNuUk5tcGdwam0yQVJkRnRuMHNib3dNSlpGQ2tTekg1Z0JaQTlQbW1rWWpjajNtOGY0UW0xU0crOHcwdzdkY1VNaWdxVmR0bXpjTHNFMjJLZlBmVkRsZ0dVZDBxSkV5ZTRqT01EcmNhZC9iMkgyOU40bVVFbThTS1dDRHRnU0ZtQU9KblhCUFRrUE1HMzlMNWo4MUFkeSttdCtNVU11YkF1Q2t1TXhIUUpIZFdaSVduSklPZTNLcDhaRHo5c1dnb2JkL05oZEY0MXNyUWxhUitWbHdGZzZmRW15TUROd1c4bk5UZFlVZW9oNStkWnI5K3dXVTVZTU80TzF4NFBQK3l5M2QxRytaMW4wMVpQbjkwNUQwOFN2dG5pdmVjYWc1Q0VQZ05uc09TRzV1TEV3VW45ODJnd3R2SU45WnBwejRlcjVaR0RkSXlpR0xsVmhmRUZwMFBDMHd0ZkdzeUx6bzROdU1aWGc2R0N2SDNGckduNjhKQjg4a2NXaFQ3N2NOaTdETEo3bXZQVng5SmZaMVVtR2FBMmE1MmZRU0VyeVp4SThaRnRYM0E2Y2NLdVZ1MmlsY2pVeDJpUEl6cU5yNmh5ejdzc2ZNSGtsS3pqL3FXN1Bjck1yRHo5d2R6MHc0aUIyU2hGYkhVc2pIWE5DcTBWSGlTN0Z6L1FmNGFUamZZMEFmRVJOUlU2QVg1MTFIL2hKVUUrZ0lHbldUMFkrVWFreDNXMHFKTzJuVHhqVnJEc3FuWEVvSklYWVY0cUlsUjV4dkpydTk1N2cwem82WVFLTklGQUI1bVZnTEVYbERnWVpoVG10dHFZTUdwZWgxYlNKb1NpaHcra016c0pwMUc1VkVidkxrZG1oSFpZYXdrbjN6eWViZlVySVYvZDlHSElpQTk1UHBxSlB2dFFBUnpq -------------------------------------------------------------------------------- * DO NOT TRY TO RECOVER FILES YOURSELF! * DO NOT MODIFY ENCRYPTED FILES! * * * OTHERWISE, YOU MAY LOSE ALL YOUR FILES FOREVER! * * * HdDkxl4TcBFZoRlDaIWzJQyXq1nAs
URLs

http://avaddonbotrxmuyl.onion

Targets

    • Target

      e24f69aa8738d14b85ad76a1783d51120b8b6ba467190fe7d8f96ad2969c8fdf.exe

    • Size

      2.1MB

    • MD5

      ccede1200a6e8eff54a358fa1e6d119a

    • SHA1

      e62fbe82dc5c1efbdecfd94791e023002d3c178b

    • SHA256

      e24f69aa8738d14b85ad76a1783d51120b8b6ba467190fe7d8f96ad2969c8fdf

    • SHA512

      d4c7e45c2f509e43b521bfbcd67474ef271fa12088f7a57794ba866cdd41ddd3e9ee8fc776b31dd0a0811e62542b813e97c0f3404f4e416066c1338193f7f6c7

    • SSDEEP

      49152:Q6otv8NVQqr7XXpwM+DbhzFG13Dyz6fRG+A+85fbhl7zsPS0mc+8aun:QDB8XQqDXf+D9FG1dp9m5fb37zsf+yn

    • Avaddon

      Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

    • Avaddon payload

    • UAC bypass

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

    • Renames multiple (204) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v13

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Indicator Removal

2
T1070

File Deletion

2
T1070.004

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Discovery

System Information Discovery

3
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Impact

Inhibit System Recovery

2
T1490

Tasks