avaddon

General

Target
2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry
Size 5.3MB
Sample260211-cf2mtsey5c
SHA256 f748129354683c8ebbf7c442ea646eacb5c68ec27d5d42c5a351038f4503e5df
MD5 7c1c97f4a76c7e059b1c97a495eddb38
SHA1 1a78dd079852c331103205daf87fab6d0ea4725b
SHA512 e51a1b6f28e6a1b68dec868c2cb8a1cef34946c583254bcf9602af7008f95485fde193a20416ae3a6a221fd19296419a72813efebc081fbb7810831217c10692
SSDEEP 49152:9k4eR6D4daqOYHMnogsCvcGGAaXxSFmvnFkD1gLK2JQIOzM8zC+zX6Gij8h+l3SE:9kfHqoCvcGGnXxSDD+YuGCn
TLSH
T1CD46AE40FA53A1E8CE5B1570206FA73ACA344D0C4739CFE3EFE85D64BA5B3915829A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\signatures\known_onion_urls.json

avaddon

Ransom Note

[ { "url": "marketojbwagqnwx.onion", "family": "marketo" }, { "url": "g5sbltooh2okkcb2.onion", "family": "marketo" }, { "url": "fvki3hj7uxuirxpeop6chgqoczanmebutznt2mkzy6waov6w456vjuid.onion", "family": "marketo" }, { "url": "jvdamsif53dqjycuozlaye2s47p7xij4x6hzwzwhzrqmv36gkyzohhqd.onion", "family": "marketo" }, { "url": "xqkz2rmrqkeqf6sjbrb47jfwnqxcd4o2zvaxxzrpbh2piknms37rw2ad.onion", "family": "synack" }, { "url": "x2miyuiwpib2imjr5ykyjngdu7v6vprkkhjltrk4qafymtawey4qzwid.onion", "family": "suncrypt" }, { "url": "nbzzb6sa6xuura2z.onion", "family": "suncrypt" }, { "url": "rbvuetuneohce3ouxjlbxtimyyxokb4btncxjbo44fbgxqy7tskinwad.onion", "family": "lv" }, { "url": "4qbxi3i2oqmyzxsjg4fwe4aly3xkped52gq5orp6efpkeskvchqe27id.onion", "family": "lv" }, { "url": "lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion", "family": "lorenz" }, { "url": "zqaflhty5hyziovsxgqvj2mrz5e5rs6oqxzb54zolccfnvtn5w2johad.onion", "family": "lockbit2" }, { "url": "yq43odyrmzqvyezdindg2tokgogf3pn6bcdtvgczpz5a74tdxjbtk2yd.onion", "family": "lockbit2" }, { "url": "oyarbnujct53bizjguvolxou3rmuda2vr72osyexngbdkhqebwrzsnad.onion", "family": "lockbit2" }, { "url": "lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion", "family": "lockbit2" }, { "url": "lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion", "family": "lockbit2" }, { "url": "hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion", "family": "hiveleak" }, { "url": "hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion", "family": "hiveleak" }, { "url": "hiveapi4nyabjdfz2hxdsr7otrcv6zq6m4rk5i2w7j64lrtny4b7vjad.onion", "family": "hiveleak" }, { "url": "3kp6j22pz3zkv76yutctosa6djpj4yib2icvdqxucdaxxedumhqicpad.onion", "family": "arvinclub" }, { "url": "arvinc7prj6ln5wpd6yydfqulsyepoc7aowngpznbn3lrap2aib6teid.onion", "family": "arvinclub" }, { "url": "avosqxh72b5ia23dl5fgwcpndkctuzqvh2iefk5imp3pi5gfhel5klad.onion", "family": "avoslocker" }, { "url": "avosjon4pfh3y7ew3jdwz6ofw7lljcxlbk7hcxxmnxlh5kvf2akcqjad.onion", "family": "avoslocker" }, { "url": "griefcameifmv4hfr3auozmovz5yi6m3h3dwbuqw7baomfxoxz4qteid.onion", "family": "grief" }, { "url": "avaddongun7rngel.onion", "family": "avaddon" }, { "url": "4hzyuotli6maqa4u.onion", "family": "vicesociety" }, { "url": "vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad.onion", "family": "vicesociety" }, { "url": "ecdmr42a34qovoph557zotkfvth4fsz56twvwgiylstjup4r5bpc4oad.onion", "family": "vicesociety" }, { "url": "wmp2rvrkecyx72i3x7ejhyd3yr6fn5uqo7wfus7cz7qnwr6uzhcbrwad.onion", "family": "vicesociety" }, { "url": "ssq4zimieeanazkzc5ld4v5hdibi2nzwzdibfh5n5w4pw5mcik76lzyd.onion", "family": "vicesociety" }, { "url": "ml3mjpuhnmse4kjij7ggupenw34755y4uj7t742qf7jg5impt5ulhkid.onion", "family": "vicesociety" }, { "url": "xingnewj6m4qytljhfwemngm7r7rogrindbq7wrfeepejgxc3bwci7qd.onion", "family": "xinglocker" }, { "url": "darksidc3iux462n6yunevoag52ntvwp6wulaz3zirkmh4cnz6hhj7id.onion", "family": "darkside" }, { "url": "rgleak7op734elep.onion", "family": "ragnarlocker" }, { "url": "rgleaktxuey67yrgspmhvtnrqtgogur35lwdrup4d3igtbm3pupc4lyd.onion", "family": "ragnarlocker" }, { "url": "p6o7m73ujalhgkiv.onion", "family": "ragnarlocker" }, { "url": "ragnarnwvli32xnmwudsvhbl7klzmofxeylyhcqfc5ifx5mbybq3ekqd.onion", "family": "ragnarlocker" }, { "url": "ekbgzchl6x2ias37.onion", "family": "clop" }, { "url": "santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion", "family": "clop" }, { "url": "toznnag5o3ambca56s2yacteu7q7x2avrfherzmz4nmujrjuib4iusad.onion", "family": "clop" }, { "url": "rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion", "family": "netwalker" }, { "url": "hpoo4dosa3x4ognfxpqcrjwnsigvslm7kv6hvmhh2yqczaxy3j6qnwad.onion", "family": "doppelpaymer" }, { "url": "dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion", "family": "revil" }, { "url": "aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion", "family": "revil" }, { "url": "blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd.onion", "family": "revil" }, { "url": "ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion", "family": "everest" }, { "url": "ransomoefralti2zh5nrv7iqybp3d5b4a2eeecz5yjosp7ggbepj7iyd.onion", "family": "everest" }, { "url": "wobpitin77vdsdiswr43duntv6eqw4rvphedutpaxycjdie6gg3binad.onion", "family": "ragnarok" }, { "url": "sushlnty2j7qdzy64qnvyb6ajkwg7resd3p6agc2widnawodtcedgjid.onion", "family": "ragnarok" }, { "url": "continewsnv5otx5kaoje7krkto2qbu3gtqef22mnr7eaxw3y6ncz3ad.onion", "family": "conti" }, { "url": "pysa2bitc5ldeyfak4seeruqymqs4sj5wt5qkcq7aoyg4h2acqieywad.onion", "family": "pysa" }, { "url": "hxt254aygrsziejn.onion", "family": "nefilim" }, { "url": "xfr3txoorcyy7tikjgj5dk3rvo3vsrpyaxnclyohkbfp3h277ap4tiad.onion", "family": "maze" }, { "url": "mountnewsokhwilx.onion", "family": "mount-locker" }, { "url": "nq4zyac4ukl4tykmidbzgdlvaboqeqsemkp4t35bzvjeve6zm2lqcjid.onion", "family": "babuk" }, { "url": "rnsm777cdsjrsdlbs4v5qoeppu3px6sb2igmh53jzrx7ipcrbjz5b2ad.onion", "family": "ransomexx" }, { "url": "cuba4mp6ximo2zlo.onion", "family": "cuba" }, { "url": "cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion", "family": "cuba" }, { "url": "pay2key2zkg7arp3kv3cuugdaqwuesifnbofun4j6yjdw5ry7zw2asid.onion", "family": "pay2key" }, { "url": "anewset3pcya3xvk73hj7yunuamutxxsm5sohkdi32blhmql55tvgqad.onion", "family": "aztroteam" }, { "url": "wm6mbuzipviusuc42kcggzkdpbhuv45sn7olyamy6mcqqked3waslbqd.onion", "family": "lockdata" }, { "url": "bl4cktorpms2gybrcyt52aakcxt6yn37byb65uama5cimhifcscnqkid.onion", "family": "blacktor" }, { "url": "ft4zr2jzlqoyob7yg4fcpwyt37hox3ajajqnfkdvbfrkjioyunmqnpad.onion", "family": "haron" }, { "url": "54rdhzjzc4ids4u4wata4zr4ywfon5wpz2ml4q3avelgadpvmdal2vqd.onion", "family": "darkleakmarket" }, { "url": "aby6efzmp7jzbwgidgqc6ghxi2vwpo6d7eaood5xuoxutrfofsmzcjqd.onion", "family": "darkleakmarket" }, { "url": "darklmmmfuonklpy6s3tmvk5mrcdi7iapaw6eka45esmoryiiuug6aid.onion", "family": "darkleakmarket" }, { "url": "darkleakyqmv62eweqwy4dnhaijg4m4dkburo73pzuqfdumcntqdokyd.onion", "family": "darkleakmarket" }, { "url": "promethw27cbrcot.onion", "family": "prometheus" }, { "url": "blackmax7su6mbwtcyo3xwtpfxpm356jjqrs34y4crcytpw7mifuedyd.onion", "family": "blackmatter" }, { "url": "vbmisqjshn4yblehk2vbnil53tlqklxsdaztgphcilto3vdj4geao5qd.onion", "family": "payloadbin" }, { "url": "ws3dh6av66sjbxxkjpw5ao3wqzmtejnkzheswm4dz5rrwvular7xvkqd.onion", "family": "groove" }, { "url": "kwvhrdibgmmpkhkidrby4mccwqpds5za6uo2thcw5gz75qncv7rbhyad.onion", "family": "ako" }, { "url": "mhdehvkomeabau7gsetnsrhkfign4jgnx3wajth5yb5h6kvzbd72wlqd.onion", "family": "atomsilo" }, { "url": "l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion", "family": "atomsilo" }, { "url": "avos2fuj6olp6x36.onion", "family": "avos" }, { "url": "6iaj3efye3q62xjgfxyegrufhewxew7yt4scxjd45tlfafyja6q4ctqd.onion", "family": "blackbyte" }, { "url": "f5uzduboq4fa2xkjloprmctk7ve3dm46ff7aniis66cbekakvksxgeqd.onion", "family": "blackbyte" }, { "url": "dlyo7r3n4qy5fzv4645nddjwarj7wjdd6wzckomcyc7akskkxp4glcad.onion", "family": "blackbyte" }, { "url": "fl3xpz5bmgzxy4fmebhgsbycgnz24uosp3u4g33oiln627qq3gyw37ad.onion", "family": "blackbyte" }, { "url": "ce6roic2ykdjunyzazsxmjpz5wsar4pflpoqzntyww5c2eskcp7dq4yd.onion", "family": "blackbyte" }, { "url": "jbeg2dct2zhku6c2vwnpxtm2psnjo2xnqvvpoiiwr5hxnc6wrp3uhnad.onion", "family": "blackbyte" }, { "url": "53d5skw4ypzku4bfq2tk2mr3xh5yqrzss25sooiubmjz67lb3gdivcad.onion", "family": "blackbyte" }, { "url": "tj3ty2q5jm5au3bmd2embtjscd3qjt7nfio2o7cr6moyy5kgil5pieqd.onion", "family": "blackbyte" }, { "url": "mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion", "family": "lolnek" }, { "url": "obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion", "family": "lolnek" }, { "url": "nclen75pwlgebpxpsqhlcnxsmdvpyrr7ogz36ehhatfmkvakeyden6ad.onion", "family": "lolnek" }, { "url": "mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion", "family": "lolnek" }, { "url": "544corkfh5hwhtn4.onion", "family": "blackshadow" }, { "url": "bonacifryrxr4siz6ptvokuihdzmjzpveruklxumflz5thmkgauty2qd.onion", "family": "bonacigroup" }, { "url": "d57uremugxjrafyg.onion", "family": "crylock" }, { "url": "veqlxhq7ub5qze3qy56zx2cig2e6tzsgxdspkubwbayqije6oatma6id.onion", "family": "ech0raix" }, { "url": "dg5fyig37abmivryrxlordrczn6d6r5wzcfe2msuo5mbbu2exnu46fid.onion", "family": "ep918" }, { "url": "7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion", "family": "exorcist" }, { "url": "ixltdyumdlthrtgx.onion", "family": "hades" }, { "url": "3r6n77mpe737w4sbxxxrpc5phbluv6xhtdl5ujpnlvmck5tc7blq2rqd.onion", "family": "hellokitty" }, { "url": "r6d636w47ncnaukrpvlhmtdbvbeltc6enfcuuow3jclpmyga7cz374qd.onion", "family": "hotarus" }, { "url": "3nvzqyo6l4wkrzumzu5aod7zbosq4ipgf7ifgj3hsvbcr5vcasordvqd.onion", "family": "karma" }, { "url": "lockbitkodidilol.onion", "family": "lockbit" }, { "url": "xembshruusobgbvxg4tcjs3jpdnks6xrr6nbokfxadcnlc53yxir22ad.onion", "family": "mbc" }, { "url": "5s4ixqul2enwxrqv.onion", "family": "mydecryptor" }, { "url": "n3twormruynhn3oetmxvasum2miix2jgg56xskdoyihra4wthvlgyeyd.onion", "family": "n3tworm" }, { "url": "zjoxyw5mkacojk5ptn2iprkivg5clow72mjkyk5ttubzxprjjnwapkad.onion", "family": "nemty" }, { "url": "5mvifa3xq5m7sou3xzaajfz7h6eserp5fnkwotohns5pgbb5oxty3zad.onion", "family": "onepercent" }, { "url": "msaoyrayohnp32tcgwcanhjouetb5k54aekgnwg7dcvtgtecpumrxpqd.onion", "family": "prolock" }, { "url": "gvka2m4qt5fod2fltkjmdk4gxh5oxemhpgmnmtjptms6fkgfzdd62tad.onion", "family": "qlocker" }, { "url": "37rckgo66iydpvgpwve7b2el5q2zhjw4tv4lmyewufnpx4lhkekxkoqd.onion", "family": "ranzy" }, { "url": "vfokxcdzjbpehgit223vzdzwte47l3zcqtafj34qrr26htjo4uf3obid.onion", "family": "vfokx" }, { "url": "746pbrxl7acvrlhzshosye3b3udk4plurpxt2pp27pojfhkkaooqiiqd.onion", "family": "vfokx" }, { "url": "wj3b2wtj7u2bzup75tzhnso56bin6bnvsxcbwbfcuvzpc4vcixbywlid.onion", "family": "xinof" }, { "url": "spookuhvfyxzph54ikjfwf2mwmxt572krpom7reyayrmxbkizbvkpaid.onion", "family": "spook" }, { "url": "wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion", "family": "RAMP" }, { "url": "rampjcdlqvgkoz5oywutpo6ggl7g6tvddysustfl6qzhr5osr24xxqqd.onion", "family": "RAMP" }, { "url": "ramp4u5iz4xx75vmt6nk5xfrs5mrmtokzszqxhhkjqlk7pbwykaz7zid.onion", "family": "RAMP" }, { "url": "54bb47h5qu4k7l4d7v5ix3i6ak6elysn3net4by4ihmvrhu7cvbskoqd.onion", "family": "sabbath" }, { "url": "quantum445bh3gzuyilxdzs5xdepf3b7lkcupswvkryf3n7hgzpxebid.onion", "family": "quantum" }, { "url": "22rnyep2aa2exx3fdm26p4onwjfmhciodb55v5l3w4iny7e5bxpg3yad.onion", "family": "quantum" }, { "url": "qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion", "family": "medusa" }, { "url": "medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion", "family": "medusa" }, { "url": "medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion", "family": "medusa" }, { "url": "xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion", "family": "medusa" }, { "url": "kyfiw76eol6ph2mq7pi5e5tdvce37bicddhai62qhdc5ja6jdchz4qqd.onion", "family": "medusa" }, { "url": "s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion", "family": "medusa" }, { "url": "cx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd.onion", "family": "medusa" }, { "url": "62foekhv5humjrfwjdyd2dgextpbf5i7obguhwvfoghmu3nxpkmxlcid.onion", "family": "medusa" }, { "url": "hl66646wtlp2naoqnhattngigjp5palgqmbwixepcjyq5i534acgqyad.onion", "family": "snatch" }, { "url": "midasbkic5eyfox4dhnijkzc7v7e4hpmsb2qgux7diqbpna4up4rtdad.onion", "family": "midas" }, { "url": "leaksv7sroztl377bbohzl42i3ddlfsxopcb6355zc7olzigedm5agad.onion", "family": "entropy" }, { "url": "mosesstaffm7hptp.onion", "family": "mosesstaff" }, { "url": "z6mikrtphid5fmn52nbcbg25tj57sowlm3oc25g563yvsfmygkcxqbyd.onion", "family": "cooming" }, { "url": "teo7aj5mfgzxyeme.onion", "family": "cooming" }, { "url": "gamol6n6p2p4c3ad7gxmx3ur7wwdwlywebo2azv3vv5qlmjmole2zbyd.onion", "family": "rook" }, { "url": "tdoe2fiiamwkiadhx2a4dfq56ztlqhzl2vckgwmjtoanfaya4kqvvvyd.onion", "family": "unknown" }, { "url": "darktorhvabc652txfc575oendhykqcllb7bh7jhhsjduocdlyzdbmqd.onion", "family": "unknown" }, { "url": "t2tqvp4pctcr7vxhgz5yd5x4ino5tw7jzs3whbntxirhp32djhi7q3id.onion", "family": "rransom" }, { "url": "babydovegkmhbontykziyq7qivwzy33mu4ukqefe4mqpiiwd3wibnjqd.onion", "family": "babyduck" }, { "url": "alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion", "family": "alphv" }, { "url": "2cuqgeerjdba2rhdiviezodpu3lc4qz2sjf4qin6f7std2evleqlzjid.onion", "family": "alphv" }, { "url": "vqifktlreqpudvulhbzmc5gocbeawl67uvs2pttswemdorbnhaddohyd.onion", "family": "alphv" }, { "url": "alphvuzxyxv6ylumd2ngp46xzq3pw6zflomrghvxeuks6kklberrbmyd.onion", "family": "alphv" }, { "url": "7k4yyskpz3rxq5nyokf6ztbpywzbjtdfanweup3skctcxopmt7tq7eid.onion", "family": "cryp70n1c0d3" }, { "url": "dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion", "family": "dread" }, { "url": "giphvoitymatg4cv7bxqh5dz6sn6bfscywoat4qtslztkomf5lavrayd.onion", "family": "againstthewest" }, { "url": "matmq3z3hiovia3voe2tix2x54sghc3tszj74xgdy4tqtypoycszqzqd.onion", "family": "holyghost" }, { "url": "gg5ryfgogainisskdvh4y373ap3b2mxafcibeh2lvq5x7fx76ygcosad.onion", "family": "nightsky" }, { "url": "u67aylig7i6l657wxmp274eoilaowhp3boljowa6bli63rxyzfzsbtyd.onion", "family": "ransomcartel" }, { "url": "cartelirsn5l54ehcbalyyqtfb3j7be2rpvf6ujayaf5qqmg3vlwiayd.onion", "family": "ransomcartel" }, { "url": "cartelraqonekult2cxbzzz2ukiff7v6cav3w373uuhenybgqulxm5id.onion", "family": "ransomcartel" }, { "url": "adminavf4cikzbv6mbbp7ujpwhygnn2t3egiz2pswldj32krrml42wyd.onion", "family": "adminlocker" }, { "url": "chat5sqrnzqewampznybomgn4hf2m53tybkarxk4sfaktwt7oqpkcvyd.onion", "family": "sugar" }, { "url": "zeonrefpbompx6rwdqa5hxgtp2cxgfmoymlli3azoanisze33pp3x3yd.onion", "family": "zeon" }, { "url": "gcbejm2rcjftouqbxuhimj5oroouqcuxb2my4raxqa7efkz5bd5464id.onion", "family": "freecivilian" }, { "url": "vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion", "family": "pandora" }, { "url": "3slz4povugieoi3tw7sblxoowxhbzxeju427cffsst5fo2tizepwatid.onion", "family": "stormous" }, { "url": "h3reihqb2y7woqdary2g3bmk3apgtxuyhx4j2ftovbhe3l5svev7bdyd.onion", "family": "stormous" }, { "url": "ransekgbpijp56bflufgxptwn5hej2rztx423v6sim2zrzz7xetnr2qd.onion", "family": "stormous" }, { "url": "pdcizqzjitsgfcgqeyhuee5u6uki6zy5slzioinlhx6xjnsw25irdgqd.onion", "family": "stormous" }, { "url": "stmxylixiz4atpmkspvhkym4

Targets

- Target
  2026-02-11_7c1c97f4a76c7e059b1c97a495eddb38_akira_elex_glassworm_qilin_wannacry
- Size 5.3MB
- SHA256 f748129354683c8ebbf7c442ea646eacb5c68ec27d5d42c5a351038f4503e5df
- MD5 7c1c97f4a76c7e059b1c97a495eddb38
- SHA1 1a78dd079852c331103205daf87fab6d0ea4725b
- SHA512 e51a1b6f28e6a1b68dec868c2cb8a1cef34946c583254bcf9602af7008f95485fde193a20416ae3a6a221fd19296419a72813efebc081fbb7810831217c10692
- SSDEEP 49152:9k4eR6D4daqOYHMnogsCvcGGAaXxSFmvnFkD1gLK2JQIOzM8zC+zX6Gij8h+l3SE:9kfHqoCvcGGnXxSDD+YuGCn
- TLSH
  T1CD46AE40FA53A1E8CE5B1570206FA73ACA344D0C4739CFE3EFE85D64BA5B3915829A1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution avaddon ransomware spyware stealer
- Avaddon
  Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
  ransomware avaddon
- Avaddon family
  avaddon
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Obfuscated Files or Information: Command Obfuscation
  Adversaries may obfuscate content during command execution to impede detection.
  defense_evasion
behavioral1 behavioral2