General
-
Target
bb3097aeb6e7fda5480e1de4ec140734b57d66df89bb4315c3947a43494d6f3e
-
Size
199KB
-
Sample
240417-qw4c9abd9x
-
MD5
f1be4601da1979e78ec0f260aaf3b030
-
SHA1
03eeb40b37fe977d8d945ef9c01aa75e037d73bc
-
SHA256
bb3097aeb6e7fda5480e1de4ec140734b57d66df89bb4315c3947a43494d6f3e
-
SHA512
fca0e87596b3149306de8c8df988c1a6aba43bfb9e62366c40842f58513d5726bbc60370060d9a78a766156fbf6fff42ad53de61ad2a76d46c562deae39aaa8a
-
SSDEEP
3072:DBftVMwGl7p3BduP2fD8ADnDbpuSpNkw00jI8IIImxLkl4062v5sbLZBRbh0pWZ:BHqrBjfDn/bpI0M8IJmU40nRsPRbhcWZ
Behavioral task
behavioral1
Sample
c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
C:\Users\Admin\Desktop\4aGp2X_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Documents\4aGp2X_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Downloads\4aGp2X_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Music\4aGp2X_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Music\4aGp2X_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Music\4aGp2X_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Pictures\4aGp2X_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Default\4aGp2X_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\4aGp2X_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Extracted
C:\Users\Admin\Desktop\kfhhI_readme_.txt
avaddon
http://avaddongun7rngel.onion
http://avaddonbotrxmuyl.onion
Targets
-
-
Target
c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028.exe
-
Size
483KB
-
MD5
53717dc73f61b0f9551cb62d6fca2e4a
-
SHA1
1ca9304e86632b147852767c85c57e08bdfc8855
-
SHA256
c14dd4a0831ea2548e1ddfd54b9704fe8ad0057924ede041c8c064b66690a028
-
SHA512
ae6ff8377d89cd3d1686c5a6bd7bb398bb975e4e52f7db5fbb0550783d77648558f03a13a9751d0cb6ed993621b12980d54777385802dd4c014ec22ae8d33552
-
SSDEEP
12288:WcvbX8rMmSZJ8t9ZITyDpFGIOyA4muT5WFExk8y:/zMr1SZJ8t9ZITyNzOt4dVy
Score10/10-
Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
-
Renames multiple (206) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-