avaddon

Sharing

Copy URL Twitter E-mail

General

Target
Thor Scan Results - to do - 02.17.25.zip
Size 14.3MB
Sample250625-a5q7aack6w
SHA256 65ddc21038179ef9b17ea2c5f755e9c7ce94a1a7d3cf4ea08e787b1575ef49b2
MD5 6266f6d6944a0cdbcb710d0dbd275ac8
SHA1 8446ef78a65da0fbc5ac1acc147b05775027b458
SHA512 d99d8caa7ab1f0ff09b5e5df47cb2b6fd56e32241ff9ef5434d968b9420773122dd386b44b0d0a3005b5b4c359a58ea2a5c5761247259764dda993e26a825747
SSDEEP 393216:+UzohRR4kWWTVRCWF90oTMsUUNYPe+rkmq7mLiWo:+UzAj4kWWTVEWtMsFSe+wmbe
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\M781079_thor_2025-02-17_1300.json

avaddon

Ransom Note

{"time":"2025-02-17T20:00:12Z","hostname":"M781079","level":"Notice","module":"Init","message":"Some modules and features are not available in Lite version and will be disabled","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:12Z","hostname":"M781079","level":"Notice","module":"Startup","message":"This THOR Lite license permits non-commercial use only. It is strictly prohibited to sell THOR Lite or sell services that include the use of THOR Lite. For details, see the EULA in the ./docs folder. For a special license that covers these cases, allows Sigma scanning and suppresses this message, please contact our sales via https://www.nextron-systems.com/get-started/","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:17Z","hostname":"M781079","level":"Info","module":"Startup","message":"Thor Version: 10.7.18","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:17Z","hostname":"M781079","level":"Info","module":"Startup","message":"Thor Build: abaa94915d6c (2024-11-07 01:33:10)","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:17Z","hostname":"M781079","level":"Info","module":"Startup","message":"Run on system: M781079","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Running as user: HEALTHY\\marklansing","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Netbios Domain: M781079","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"User has admin rights: no","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Notice","module":"Startup","message":"THOR should be started 'As Administrator' to have full access to files, process memory and the security eventlog","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Working Directory: C:\\Users\\marklansing\\Downloads\\thor10.7lite-win-pack (2)\\thor10.7lite-win-pack","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Thor Scan started","scanid":"S-Phu25Pdtc6Q","start_time":"2025-02-17T13:00:18.5189817-07:00","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Effective argument list: [--intense --json --resume --vtkey 126e0... --vtmode full]","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Platform: Windows 11 Enterprise","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Platform DeepEval","scanid":"S-Phu25Pdtc6Q","name":"Windows 11 Enterprise","type":"Multiprocessor Free","version":"6.3","proc":"Intel64 Family 6 Model 186 Stepping 3","arch":"AMD64","installed_on":"2024-10-22T15:47:20-06:00","build_number":"22631","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Language: en-US, Zone: MST","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"System Uptime: 4.58 days","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"CPU Count: 12","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Memory in Megabyte: 16068","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Signature Database: 2025/02/15-135307","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Successfully compiled 0 false positive filters","scanid":"S-Phu25Pdtc6Q","type":"log filter","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Writing report file to: M781079_thor_2025-02-17_1300.txt","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Writing csv report file to: M781079_files_md5s.csv","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Writing json report file to: M781079_thor_2025-02-17_1300.json","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Writing html report file to: M781079_thor_2025-02-17_1300.html","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"Syslog Export: off","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"IP Address 1: 10.63.106.62","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"IP Address 2: 192.168.1.25","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"ScanID: S-Phu25Pdtc6Q","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Startup","message":"System is not a domain controller","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Intense Scan Mode","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Max. file size to be scanned is 209.7 MB, use --max_file_size to increase the limit","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Selected modules: AtJobs, Autoruns, DNSCache, EnvCheck, EtwWatcher, Eventlog, Events, Filescan, Firewall, Hosts, HotfixCheck, LSASessions, LoggedIn, MFT, Mutex, NetworkSessions, NetworkShares, Pipes, ProcessCheck, RegistryChecks, Rootkit, SHIMCache, ScheduledTasks, ServiceCheck, Timestomp, UserDir, Users, WMIStartup","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Deselected modules: Artifact-Collector, DeepDive, Dropzone, Thunderstorm","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Selected features: Amcache, Archive, ArchiveScan, AtJobs, Auditlog, AuthorizedKeys, Bifrost2, BulkScan, C2, CPULimit, CheckString, CronParser, DoublePulsar, DumpScan, ETL, EVTX, Eml, EnrichFileInfo, ExeDecompress, FilenameIOCs, Filescan, GroupsXML, KeywordIOCs, Lnk, LogScan, Logger, MagicHeader, OLE, ParseCobaltStrike, Prefetch, ProcessConnections, ProcessHandles, ProcessIntegrity, ProgressTracker, RecycleBin, RegistryHive, Rescontrol, SHIMCache, Sigma, SignalHandler, Stix, TeamViewer, ThorDB, VirusTotal, VulnerabilityCheck, WER, WMIPersistence, WebdirScan, WorkerProgressTracker, Yara","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Deselected features: AuditTrail, AuditTrailWriter, Bifrost","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"System Type: Workstation","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"License file found","scanid":"S-Phu25Pdtc6Q","license":"C:\\Users\\marklansing\\Downloads\\thor10.7lite-win-pack (2)\\thor10.7lite-win-pack\\thor-lite-6a03c042-c1a371a2-20250201-20250804.lic","owner":"[email protected]","type":"Lite","starts":"2025/02/01","expires":"2025/08/04","scanner":"THOR Lite","valid":"true","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module RegistryChecks due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module Rootkit due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module NetworkShares due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module AtJobs due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module LSASessions due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module ServiceCheck due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module UserDir due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module Users due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module Pipes due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module Events due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module NetworkSessions due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module Timestomp due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module WMIStartup due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module HotfixCheck due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module EtwWatcher due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module Firewall due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module LoggedIn due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module Mutex due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module DNSCache due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module SHIMCache due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module ScheduledTasks due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module Hosts due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module Eventlog due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module MFT due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling module EnvCheck due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature EVTX due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature RecycleBin due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature WebdirScan due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature AtJobs due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature VulnerabilityCheck due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature Archive due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature DoublePulsar due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature DumpScan due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature GroupsXML due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature ProgressTracker due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature RegistryHive due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature WorkerProgressTracker due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature Amcache due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature Auditlog due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-17T20:00:18Z","hostname":"M781079","level":"Info","module":"Init","message":"Disabling feature Lnk due to Lite version","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"} {"time":"2025-02-1

Emails

2)\\thor10.7lite-win-pack\\thor-lite-6a03c042-c1a371a2-20250201-20250804.lic","owner":"[email protected]","type":"Lite","starts":"2025/02/01","expires":"2025/08/04","scanner":"THOR

URLs

https://www.nextron-systems.com/get-started/","scanid":"S-Phu25Pdtc6Q","log_version":"v1.0.0"}

Targets

- Target
  Thor Scan Results - to do - 02.17.25.zip
- Size 14.3MB
- SHA256 65ddc21038179ef9b17ea2c5f755e9c7ce94a1a7d3cf4ea08e787b1575ef49b2
- MD5 6266f6d6944a0cdbcb710d0dbd275ac8
- SHA1 8446ef78a65da0fbc5ac1acc147b05775027b458
- SHA512 d99d8caa7ab1f0ff09b5e5df47cb2b6fd56e32241ff9ef5434d968b9420773122dd386b44b0d0a3005b5b4c359a58ea2a5c5761247259764dda993e26a825747
- SSDEEP 393216:+UzohRR4kWWTVRCWF90oTMsUUNYPe+rkmq7mLiWo:+UzAj4kWWTVEWtMsFSe+wmbe
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1
- Target
  Thor Scan Results/M781079_files_md5s.csv
- Size 47KB
- SHA256 4e17b971eeace796c6263ad872fe340bc24a318c4d62a750c7dd09acfcbc0ee4
- MD5 091f60f830f05f50a76729d7070d3ed0
- SHA1 7a51b8262d157fd1aed6e6ca053b219055f696cd
- SHA512 49c71bd601e4063da313d49faf22ed775a02f964a0bff1b57d5f29f2dcb0b1adde64486c6a2dcab404ac3847f4374faf6536542100bafbd718aed42737726914
- SSDEEP 768:ihjYqc3Agymmez2e3WGACiJ+Jtj2/hEsYY1Gj1QK2BRQ69vm3Ekx0SA/:i2qctTmbe3ViJ+J52ZEsYYY6KifZjA0Z
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2
- Target
  Thor Scan Results/M781079_thor_2025-02-02_1454.html
- Size 2.4MB
- SHA256 99c3e2b3a67d1a3127eb75ba1034388f817c2adf7cf8a782eabb08f1e065a241
- MD5 c23122fe57ca7938b843899fe82a0da5
- SHA1 c2df815dc0f807ebe6c55e2de4203826ceb75a76
- SHA512 ef684de72ae09026153057d3bf0ffd2f27da8ccf2f497ade2a373b1c4ba5feb07ec7aad49d6e1696b6635afec8f02a9fb42e8ed6836492a07b4246b809f77531
- SSDEEP 6144:5+vPijaa5Bxa3nyVj2n7e3++7toxUxWJUax50axLyu8Hax2gVOUx0EaxoaxW84eH:5+vPijaa5JR
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

discovery
behavioral3
- Target
  Thor Scan Results/M781079_thor_2025-02-02_1454.txt
- Size 2.0MB
- SHA256 5f03bffb68a70cde070499d6b180b2ea6628c23a91dfe7fcd7a5e2cfa96dc6c1
- MD5 ae661887137c5d0663ef09cb95dd2575
- SHA1 b96adbc7f58cfc3cab995e626ac7376c4f7ccc22
- SHA512 ca781a8bb80153fbea5dd76a70c58182e03d5ba7ea977e711545351f56790eec54c2f06dde4889037600ed897214e15ce01cf3cc5dfc360589fc35a6299d4447
- SSDEEP 6144:Bi725ZaPRpXizzDrCjyTIeShWYpSMBUqJ96EsAGQjsw1U+xbOD/4xyiFhCxciG6U:Bh3HMG/4lFY78QR7ET0U1pcSf
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4
- Target
  Thor Scan Results/M781079_thor_2025-02-16_2253.txt
- Size 3.3MB
- SHA256 65130b22b15b52f63d34cbcc58e232813ea99988627209543191fcbf9e72ff63
- MD5 9509bbfe38d594cab4108e4085bbd29c
- SHA1 60a1ec455d92f3a620f8a9ea3c9d622f3e9c08ce
- SHA512 4faac0b31ea89afc99500f38c3628fc3ab9eab74986590e9e841086031242fc9cd9818560eadedca89c41ea1bcf7453df728bff33c5870d01f907562bdc78dbf
- SSDEEP 3072:ZNXRRW2D+NPJfX7l2V0YpLisDBPwE9V/WbAEzVZfxfssYsgFJQ5K6yFdvw+McKGh:ZdNPwcW8EBB28Q6cdvucKG1b
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral5
- Target
  Thor Scan Results/M781079_thor_2025-02-16_2358.txt
- Size 3.3MB
- SHA256 f191509d18fbedecf17666ee4385d49217142dc7661f6032643864c0662dbdd2
- MD5 c0f14a16b2236e7e17f4a54399f5dcd4
- SHA1 0229ece8cf86a2150326b8c13dcde41fd2b0a715
- SHA512 8474be5774057aebf2725308c55b7528a49c438732fcf95a2564c026b73927b67ce5668c4f4717e7a066ed14ebe0b5a09ae8f18a6ae7057430b8e1eb844e5419
- SSDEEP 3072:RiKp+YWkpUUtXcDtXFUuHEBLKyCRetlFr+PViuREQkmwDExrHCWxhBFdvwVprKGS:R6aCRwrWVTemU4hzdv8rKG1Y
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral6
- Target
  Thor Scan Results/M781079_thor_2025-02-17_0020.txt
- Size 3.3MB
- SHA256 14b3f577c6aeb3d24eb32472c4aca4f180dfba6c0bfe5c82aed1fb12f470cf8c
- MD5 5a314a2e360edbd3a0e94d90a7902fc7
- SHA1 80bd10ef419c564519c2d2400adf682de339bcd5
- SHA512 b235fac1fb4f26cbde8e21a60cd49595fa4ce1981dd9f5acacbc4e2f2b7f1f3adf179724815a577e5cc45a1c432bb64dcbfaa9995a3694977a3d847b2dc260d9
- SSDEEP 3072:YNyHmfEkOU0i3LD09YdfnFxLsLIzqj7qjHhZgFtZXHZeZ+ICgIMrnmFdvwv8gKGs:YQ7IzTjBZqbpzUnQdvzgKG16
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  Thor Scan Results/M781079_thor_2025-02-17_1300.json
- Size 26.0MB
- SHA256 5cbc6aba25c2151d71a2deb58f07a86097fafb4c375458f841c1e337cafc01c7
- MD5 5790e54a37d0a74953c60e34b30a3e6f
- SHA1 3474cceee77bc5ce6dd3d0ef4c194178a32b5baf
- SHA512 9bc5221d21f46f1b709811965f2c56bee8e5dbc883e8e493f79751f4c566021a04412286b1bd809a80f96555ad6f086186acf92d06bd9927b86ed6391c94a8c5
- SSDEEP 24576:d6+XjUHx4fGH+3OeCarl+R9VK5VRHoBmknMW078JwrbrsBGZyXB8rdA8GuJr4ctV:B1gqkMDr
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

avaddon discovery ransomware
- Avaddon
  Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
  ransomware avaddon
- Avaddon family
  avaddon
behavioral8
- Target
  Thor Scan Results/M781079_thor_2025-02-17_1300.txt
- Size 14.0MB
- SHA256 a9783110f28bfe9a9ca88de00f7db3987cbeda76ae6db29c3ce221281e7d412a
- MD5 b7006f63e001549cd0c9a5ca356fdbd0
- SHA1 7e31a7d5ff4ec149c76bd19e8cbed657cc35c026
- SHA512 3c970dc0091f644df03f89029f2ed06c310fb46d443639d40e99acf5888c7f9affb79cb734857f828f5bbc3bbb75123651aa027960a3b88e35117218fc03e340
- SSDEEP 24576:CR3+JwzgYmmLcS9ezpH1nE2kf6gVChCvjWlUbSg6xgUfYt74B2GOQnuxYtG5wFGR:C00yRf96nDWxl21AK
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9
- Target
  Thor Scan Results/M781079_thor_2025-02-17_1429.txt
- Size 13.6MB
- SHA256 f1a66f276b7dc0bd83bfcff1f4f2bb08639ee3be80b354d95f660fdb9ddcb4a7
- MD5 04e1b88b483487a5a2f861c594f68129
- SHA1 7228867c68f1a6332ca7047f0d6c7a20c2fd885d
- SHA512 fc195d9acad5e2fefccbdb946a5844d20aee872b20abded1e3d21cb35753b98cded762f986a1f33d2c16c96a62199019c166625fb6beec63c4c0e0d2506370dc
- SSDEEP 24576:+EWMFIzlYFm2cSgezwH1BEckk6pDCuChjrBCmSgexgAKY77+B/dnyuuVYCy5wJGr:+sjy4V9NUCdBzikO5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  Thor Scan Results/M781079_thor_2025-02-17_1429.zip
- Size 1.9MB
- SHA256 fe247b502062a269d6ac94144bed9223a6857349ebfed5706de7346c5add99e2
- MD5 695aa3d5bbe7d29bb5739ce2370d64ad
- SHA1 f43280d13144c5aa92cd700909e16e5f1a40007f
- SHA512 b8aace99063e66306457a217c58289cbc3f0a0ba998c320f7aa2f926e1681eef407abf5a51514dc0d8396a593f054fa6ab5289b5322703b9fd0394511bb70e34
- SSDEEP 24576:g1HXQGhWpqNmhisrovvtpt9zg4EyaELkpyqSl2HC4Yl02U5fWCiK9EtnHA0/Wi:S3csvtf9XEDkkVGlNRu9Etn7
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11
- Target
  M781079_files_md5s.csv
- Size 47KB
- SHA256 4e17b971eeace796c6263ad872fe340bc24a318c4d62a750c7dd09acfcbc0ee4
- MD5 091f60f830f05f50a76729d7070d3ed0
- SHA1 7a51b8262d157fd1aed6e6ca053b219055f696cd
- SHA512 49c71bd601e4063da313d49faf22ed775a02f964a0bff1b57d5f29f2dcb0b1adde64486c6a2dcab404ac3847f4374faf6536542100bafbd718aed42737726914
- SSDEEP 768:ihjYqc3Agymmez2e3WGACiJ+Jtj2/hEsYY1Gj1QK2BRQ69vm3Ekx0SA/:i2qctTmbe3ViJ+J52ZEsYYY6KifZjA0Z
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Deletes itself
behavioral12
- Target
  M781079_thor_2025-02-17_1429.txt
- Size 13.6MB
- SHA256 f1a66f276b7dc0bd83bfcff1f4f2bb08639ee3be80b354d95f660fdb9ddcb4a7
- MD5 04e1b88b483487a5a2f861c594f68129
- SHA1 7228867c68f1a6332ca7047f0d6c7a20c2fd885d
- SHA512 fc195d9acad5e2fefccbdb946a5844d20aee872b20abded1e3d21cb35753b98cded762f986a1f33d2c16c96a62199019c166625fb6beec63c4c0e0d2506370dc
- SSDEEP 24576:+EWMFIzlYFm2cSgezwH1BEckk6pDCuChjrBCmSgexgAKY77+B/dnyuuVYCy5wJGr:+sjy4V9NUCdBzikO5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13
- Target
  Thor Scan Results/M781079_thor_2025-02-17_3000.zip
- Size 5.2MB
- SHA256 de1698981e33b774c1d2b1d19782b49616da8bd2a9be984211c44fe76bed1cc0
- MD5 4175d66751d2b3ace3e2f5143205823e
- SHA1 b0f64db9866a5f13abc2a358283228bf325c17a6
- SHA512 6f98aace036278c71a3c77c9697b4b5819041364a5dc69f06fb588f04124b6fcaa2a32c761eaa409d8fd8569e2af5318fc7badb5eb3d82f7ebe7f246fb93e272
- SSDEEP 98304:x0EHPyZGfJm1T7Rqbt04bKgzmXoCD3h5VL4GK4mRrJ4BlskgT:rqeoR7Ri04NSX/DzR4TVRC7+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral14
- Target
  M781079_files_md5s.csv
- Size 48KB
- SHA256 1041f62742caee0d3d43345a338d813a19a379d527bc9190b584682c17f7fe0d
- MD5 9bbe5eef7bd2d62b2b14bf04b6130947
- SHA1 56a728e1a49cfb9a274071799558665c606269e0
- SHA512 0cd7f2ca56512c64c7f3f38d7138a87df39ac137442fd1b0577dd8183dae8c3f66e0c9aaa3ccbe195043103717312dcb9e0f8c2387a1a8c69c242719b285af07
- SSDEEP 1536:i2qctTmbe3ViJNJ52ZEsYYY6KifZjA0SL:kQAtsrrjAT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15
- Target
  M781079_thor_2025-02-16_2253.txt
- Size 3.3MB
- SHA256 65130b22b15b52f63d34cbcc58e232813ea99988627209543191fcbf9e72ff63
- MD5 9509bbfe38d594cab4108e4085bbd29c
- SHA1 60a1ec455d92f3a620f8a9ea3c9d622f3e9c08ce
- SHA512 4faac0b31ea89afc99500f38c3628fc3ab9eab74986590e9e841086031242fc9cd9818560eadedca89c41ea1bcf7453df728bff33c5870d01f907562bdc78dbf
- SSDEEP 3072:ZNXRRW2D+NPJfX7l2V0YpLisDBPwE9V/WbAEzVZfxfssYsgFJQ5K6yFdvw+McKGh:ZdNPwcW8EBB28Q6cdvucKG1b
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral16
- Target
  M781079_thor_2025-02-16_2358.txt
- Size 3.3MB
- SHA256 f191509d18fbedecf17666ee4385d49217142dc7661f6032643864c0662dbdd2
- MD5 c0f14a16b2236e7e17f4a54399f5dcd4
- SHA1 0229ece8cf86a2150326b8c13dcde41fd2b0a715
- SHA512 8474be5774057aebf2725308c55b7528a49c438732fcf95a2564c026b73927b67ce5668c4f4717e7a066ed14ebe0b5a09ae8f18a6ae7057430b8e1eb844e5419
- SSDEEP 3072:RiKp+YWkpUUtXcDtXFUuHEBLKyCRetlFr+PViuREQkmwDExrHCWxhBFdvwVprKGS:R6aCRwrWVTemU4hzdv8rKG1Y
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral17
- Target
  M781079_thor_2025-02-17_0020.txt
- Size 3.3MB
- SHA256 14b3f577c6aeb3d24eb32472c4aca4f180dfba6c0bfe5c82aed1fb12f470cf8c
- MD5 5a314a2e360edbd3a0e94d90a7902fc7
- SHA1 80bd10ef419c564519c2d2400adf682de339bcd5
- SHA512 b235fac1fb4f26cbde8e21a60cd49595fa4ce1981dd9f5acacbc4e2f2b7f1f3adf179724815a577e5cc45a1c432bb64dcbfaa9995a3694977a3d847b2dc260d9
- SSDEEP 3072:YNyHmfEkOU0i3LD09YdfnFxLsLIzqj7qjHhZgFtZXHZeZ+ICgIMrnmFdvwv8gKGs:YQ7IzTjBZqbpzUnQdvzgKG16
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18
- Target
  M781079_thor_2025-02-17_1300.json
- Size 26.0MB
- SHA256 5cbc6aba25c2151d71a2deb58f07a86097fafb4c375458f841c1e337cafc01c7
- MD5 5790e54a37d0a74953c60e34b30a3e6f
- SHA1 3474cceee77bc5ce6dd3d0ef4c194178a32b5baf
- SHA512 9bc5221d21f46f1b709811965f2c56bee8e5dbc883e8e493f79751f4c566021a04412286b1bd809a80f96555ad6f086186acf92d06bd9927b86ed6391c94a8c5
- SSDEEP 24576:d6+XjUHx4fGH+3OeCarl+R9VK5VRHoBmknMW078JwrbrsBGZyXB8rdA8GuJr4ctV:B1gqkMDr
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10
- Drops desktop.ini file(s)
behavioral19
- Target
  M781079_thor_2025-02-17_1300.txt
- Size 14.0MB
- SHA256 a9783110f28bfe9a9ca88de00f7db3987cbeda76ae6db29c3ce221281e7d412a
- MD5 b7006f63e001549cd0c9a5ca356fdbd0
- SHA1 7e31a7d5ff4ec149c76bd19e8cbed657cc35c026
- SHA512 3c970dc0091f644df03f89029f2ed06c310fb46d443639d40e99acf5888c7f9affb79cb734857f828f5bbc3bbb75123651aa027960a3b88e35117218fc03e340
- SSDEEP 24576:CR3+JwzgYmmLcS9ezpH1nE2kf6gVChCvjWlUbSg6xgUfYt74B2GOQnuxYtG5wFGR:C00yRf96nDWxl21AK
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Avaddon family

Deletes itself

Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20