Overview

overview

10

Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SCANID S-fDcCOfEOshg - thor_2026-09-18_0208.txt
  • Size 7.4MB
  • Sample261104-lsfesszyev
  • SHA256 8c9462401754a3f4d5ce4af177c3410bc5e90d830ab6e0352b80877e7f66b4dd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
ransomwareavaddonstealerkeyloggersnakekeylogger

Malware Config

Extracted

  • avaddon

Ransom Note
  • Sep 18 08:08:15 ASUS/192.168.1.250 THOR: Notice: MODULE: Init MESSAGE: Some modules and features are not available in Lite version and will be disabled SCANID: S-fDcCOfEOshg Sep 18 08:08:15 ASUS/192.168.1.250 THOR: Notice: MODULE: Startup MESSAGE: This THOR Lite license permits non-commercial use only. It is strictly prohibited to sell THOR Lite or sell services that include the use of THOR Lite. For details, see the EULA in the ./docs folder. For a special license that covers these cases, allows Sigma scanning and suppresses this message, please contact our sales via https://www.nextron-systems.com/get-started/ SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Version: 10.7.32 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Build: 1cabaee8cbc5 (2026-09-09 10:00:28) SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Run on system: ASUS SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Running as user: ASUS\micro SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Netbios Domain: ASUS SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: User has admin rights: yes SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Working Directory: C:\thor-lite-windows_10.7.29 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Thor Scan started SCANID: S-fDcCOfEOshg START_TIME: Fri Sep 18 02:08:20 2026 HOSTNAME: ASUS Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Effective argument list: [--allhds --alldrives --follow-symlinks --max-nested-objects 100000 --intense --nocpulimit --norescontrol --force-max-file-size --allfiles --c2-in-memory --full-proc-integrity --resume --vtkey 126e0... --vtmode full --vtscore 30 --vtaccepteula --vtwaitforquota] SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform: Windows 11 Home SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Platform DeepEval SCANID: S-fDcCOfEOshg NAME: Windows 11 Home TYPE: Multiprocessor Free VERSION: 6.3 PROC: Intel64 Family 6 Model 122 Stepping 8 ARCH: AMD64 INSTALLED_ON: Thu Apr 23 01:54:08 2026 BUILD_NUMBER: 26200 Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Language: en-CA, Zone: MDT SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System Uptime: 1.97 days SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: CPU Count: 2 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Memory in Megabyte: 3918 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Signature Database: 1.260911.111518 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Successfully compiled 0 false positive filters SCANID: S-fDcCOfEOshg TYPE: log filter Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing report file to: ASUS_thor_2026-09-18_0208.txt SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing csv report file to: ASUS_files_md5s.csv SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: No json report file will be written SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Writing html report file to: ASUS_thor_2026-09-18_0208.html SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: Syslog Export: off SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: IP Address 1: 192.168.1.250 SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: ScanID: S-fDcCOfEOshg SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Startup MESSAGE: System is not a domain controller SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Intense Scan Mode SCANID: S-fDcCOfEOshg Sep 18 08:08:20 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Max. file size to be scanned is 209.7 MB, use --max_file_size to increase the limit SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected modules: AtJobs, Autoruns, DNSCache, EnvCheck, EtwWatcher, Eventlog, Events, Filescan, Firewall, Hosts, HotfixCheck, LSASessions, LoggedIn, MFT, Mutex, NetworkSessions, NetworkShares, Pipes, ProcessCheck, RegistryChecks, Rootkit, SHIMCache, ScheduledTasks, ServiceCheck, Timestomp, UserDir, Users, WMIStartup SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected modules: Artifact-Collector, DeepDive, Dropzone, Thunderstorm SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Selected features: Amcache, Archive, ArchiveScan, AtJobs, Auditlog, AuthorizedKeys, Bifrost2, BulkScan, C2, CheckString, CronParser, DoublePulsar, DumpScan, ETL, EVTX, Eml, EnrichFileInfo, ExeDecompress, FilenameIOCs, Filescan, GroupsXML, KeywordIOCs, Lnk, LogScan, Logger, MagicHeader, OLE, ParseCobaltStrike, Prefetch, ProcessConnections, ProcessHandles, ProcessIntegrity, ProgressTracker, RecycleBin, RegistryHive, SHIMCache, Sigma, SignalHandler, Stix, TeamViewer, ThorDB, VirusTotal, VulnerabilityCheck, WER, WMIPersistence, WebdirScan, WorkerProgressTracker, Yara SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Deselected features: Action, AuditTrail, AuditTrailWriter, Bifrost, CPULimit, Rescontrol SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: System Type: Workstation SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: License file found SCANID: S-fDcCOfEOshg LICENSE: C:\thor-lite-windows_10.7.29\8cbc51cde68eeb54202cdcb836ff5680_5a3bb052dcf94229a61dbffb25755169.lic OWNER: [email protected] TYPE: Lite STARTS: 2026/03/18 EXPIRES: 2026/09/18 SCANNER: THOR Lite VALID: true Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkShares due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module HotfixCheck due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Pipes due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Hosts due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Users due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LSASessions due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Firewall due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ScheduledTasks due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module WMIStartup due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EnvCheck due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module NetworkSessions due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module RegistryChecks due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module SHIMCache due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Timestomp due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Events due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module EtwWatcher due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Eventlog due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module MFT due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Rootkit due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module ServiceCheck due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module DNSCache due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module Mutex due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module UserDir due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module AtJobs due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling module LoggedIn due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VirusTotal due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WMIPersistence due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AuthorizedKeys due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature BulkScan due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RecycleBin due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Sigma due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Auditlog due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Prefetch due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature VulnerabilityCheck due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Lnk due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature OLE due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WorkerProgressTracker due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WER due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature CronParser due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ExeDecompress due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature GroupsXML due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature MagicHeader due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature ProgressTracker due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SHIMCache due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature SignalHandler due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature DoublePulsar due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Logger due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature WebdirScan due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Stix due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature TeamViewer due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature AtJobs due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature EVTX due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Eml due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature RegistryHive due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Amcache due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Disabling feature Bifrost2 due to Lite version SCANID: S-fDcCOfEOshg Sep 18 08:08:21 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-all.yas as 'default' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-deepscan-selectors.yasx as 'meta' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-keywords.yas as 'keyword' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-log-sigs.yas as 'log' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-meta.yas as 'meta' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-peids.yas as 'default' type SCANID: S-fDcCOfEOshg Sep 18 08:08:26 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-process-memory-sigs.yas as 'process' type SCANID: S-fDcCOfEOshg Sep 18 08:08:27 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from thor-lite-registry.yas as 'registry' type SCANID: S-fDcCOfEOshg Sep 18 08:08:27 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32_and_resources_dropper_v1_45_to_v4_x.yara as 'default' and 'custom' type SCANID: S-fDcCOfEOshg Sep 18 08:08:27 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact32svc_exe_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-fDcCOfEOshg Sep 18 08:08:28 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_artifact64_v1_49_to_v4_x.yara as 'default' and 'custom' type SCANID: S-fDcCOfEOshg Sep 18 08:08:28 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_beacon_dll_all_versions_memenabled.yara as 'default' and 'custom' type SCANID: S-fDcCOfEOshg Sep 18 08:08:28 ASUS/192.168.1.250 THOR: Info: MODULE: Init MESSAGE: Adding rule set from cobaltstrike__resources_bind64_bin_v2_5_through_v4_x.yara as 'defa
URLs

  • https://www.nextron-systems.com/get-started/

Signatures

  • Family: Avaddon

    Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.

    ransomwareavaddon
  • Family: Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

File Explorer

  • SCANID S-fDcCOfEOshg - thor_2026-09-18_0208.txt
    7.4MB

SCANID S-fDcCOfEOshg - thor_2026-09-18_0208.txt

  • SHA256 8c9462401754a3f4d5ce4af177c3410bc5e90d830ab6e0352b80877e7f66b4dd
  • MD5 SHA1 SHA512 SSDEEP TLSH