SYMBOLCOMMON_NAMEaka. SYNONYMS
win.avaddon (Back to overview)

Avaddon

Actor(s): RIDDLE SPIDER


Avaddon is a ransomware malware targeting Windows systems often spread via malicious spam. The first known attack where Avaddon ransomware was distributed was in February 2020. Avaddon encrypts files using the extension .avdn and uses a TOR payment site for the ransom payment.

References
2022-04-12ConnectWiseConnectWise CRU
@online{cru:20220412:threat:2357d34, author = {ConnectWise CRU}, title = {{Threat Profile: Avaddon}}, date = {2022-04-12}, organization = {ConnectWise}, url = {https://www.connectwise.com/resources/avaddon-profile}, language = {English}, urldate = {2022-04-13} } Threat Profile: Avaddon
Avaddon
2022-03-23splunkShannon Davis
@online{davis:20220323:gone:56f570f, author = {Shannon Davis}, title = {{Gone in 52 Seconds…and 42 Minutes: A Comparative Analysis of Ransomware Encryption Speed}}, date = {2022-03-23}, organization = {splunk}, url = {https://www.splunk.com/en_us/blog/security/gone-in-52-seconds-and-42-minutes-a-comparative-analysis-of-ransomware-encryption-speed.html}, language = {English}, urldate = {2022-03-25} } Gone in 52 Seconds…and 42 Minutes: A Comparative Analysis of Ransomware Encryption Speed
Avaddon Babuk BlackMatter Conti DarkSide LockBit Maze Mespinoza REvil Ryuk
2022-03-17SophosTilly Travers
@online{travers:20220317:ransomware:df38f2f, author = {Tilly Travers}, title = {{The Ransomware Threat Intelligence Center}}, date = {2022-03-17}, organization = {Sophos}, url = {https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/}, language = {English}, urldate = {2022-03-18} } The Ransomware Threat Intelligence Center
ATOMSILO Avaddon AvosLocker BlackKingdom Ransomware BlackMatter Conti Cring DarkSide dearcry Dharma Egregor Entropy Epsilon Red Gandcrab Karma LockBit LockFile Mailto Maze Nefilim RagnarLocker Ragnarok REvil RobinHood Ryuk SamSam Snatch WannaCryptor WastedLocker
2022-02-23splunkShannon Davis, SURGe
@techreport{davis:20220223:empirically:fe03729, author = {Shannon Davis and SURGe}, title = {{An Empirically Comparative Analysis of Ransomware Binaries}}, date = {2022-02-23}, institution = {splunk}, url = {https://www.splunk.com/en_us/pdfs/resources/whitepaper/an-empirically-comparative-analysis-of-ransomware-binaries.pdf}, language = {English}, urldate = {2022-03-25} } An Empirically Comparative Analysis of Ransomware Binaries
Avaddon Babuk BlackMatter Conti DarkSide LockBit Maze Mespinoza REvil Ryuk
2022-01-19MandiantAdrian Sanchez Hernandez, Paul Tarter, Ervin James Ocampo
@online{hernandez:20220119:one:b4b3bf7, author = {Adrian Sanchez Hernandez and Paul Tarter and Ervin James Ocampo}, title = {{One Source to Rule Them All: Chasing AVADDON Ransomware}}, date = {2022-01-19}, organization = {Mandiant}, url = {https://www.mandiant.com/resources/chasing-avaddon-ransomware}, language = {English}, urldate = {2022-01-24} } One Source to Rule Them All: Chasing AVADDON Ransomware
BlackMatter Avaddon BlackMatter MedusaLocker SystemBC ThunderX
2021-10-12CrowdStrikeCrowdStrike Intelligence Team
@online{team:20211012:ecx:5540ee9, author = {CrowdStrike Intelligence Team}, title = {{ECX: Big Game Hunting on the Rise Following a Notable Reduction in Activity}}, date = {2021-10-12}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/big-game-hunting-on-the-rise-again-according-to-ecrime-index/}, language = {English}, urldate = {2021-11-02} } ECX: Big Game Hunting on the Rise Following a Notable Reduction in Activity
Babuk BlackMatter DarkSide REvil Avaddon Babuk BlackMatter DarkSide LockBit Mailto REvil
2021-09-14CrowdStrikeCrowdStrike Intelligence Team
@online{team:20210914:big:b345561, author = {CrowdStrike Intelligence Team}, title = {{Big Game Hunting TTPs Continue to Shift After DarkSide Pipeline Attack}}, date = {2021-09-14}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/how-big-game-hunting-ttps-shifted-after-darkside-pipeline-attack/}, language = {English}, urldate = {2021-09-19} } Big Game Hunting TTPs Continue to Shift After DarkSide Pipeline Attack
BlackMatter DarkSide REvil Avaddon BlackMatter Clop Conti CryptoLocker DarkSide DoppelPaymer Hades REvil
2021-08-15SymantecThreat Hunter Team
@techreport{team:20210815:ransomware:f799696, author = {Threat Hunter Team}, title = {{The Ransomware Threat}}, date = {2021-08-15}, institution = {Symantec}, url = {https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf}, language = {English}, urldate = {2021-12-15} } The Ransomware Threat
Babuk BlackMatter DarkSide Avaddon Babuk BADHATCH BazarBackdoor BlackMatter Clop Cobalt Strike Conti DarkSide DoppelPaymer Egregor Emotet FiveHands FriedEx Hades IcedID LockBit Maze MegaCortex MimiKatz QakBot RagnarLocker REvil Ryuk TrickBot WastedLocker
2021-07-22S2W LAB Inc.TALON
@online{talon:20210722:quick:7951b68, author = {TALON}, title = {{Quick analysis of Haron Ransomware (feat. Avaddon and Thanos)}}, date = {2021-07-22}, organization = {S2W LAB Inc.}, url = {https://medium.com/s2wlab/quick-analysis-of-haron-ransomware-feat-avaddon-and-thanos-1ebb70f64dc4}, language = {English}, urldate = {2021-07-26} } Quick analysis of Haron Ransomware (feat. Avaddon and Thanos)
Avaddon Hakbit
2021-06-16Advanced IntelligenceVitali Kremez, Yelisey Boguslavskiy
@online{kremez:20210616:rise:8cfe240, author = {Vitali Kremez and Yelisey Boguslavskiy}, title = {{The Rise & Demise of Multi-Million Ransomware Business Empire}}, date = {2021-06-16}, organization = {Advanced Intelligence}, url = {https://www.advanced-intel.com/post/the-rise-demise-of-multi-million-ransomware-business-empire}, language = {English}, urldate = {2021-06-21} } The Rise & Demise of Multi-Million Ransomware Business Empire
Avaddon
2021-06-11Bleeping ComputerLawrence Abrams
@online{abrams:20210611:avaddon:0c89258, author = {Lawrence Abrams}, title = {{Avaddon ransomware shuts down and releases decryption keys}}, date = {2021-06-11}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/avaddon-ransomware-shuts-down-and-releases-decryption-keys/}, language = {English}, urldate = {2021-06-16} } Avaddon ransomware shuts down and releases decryption keys
Avaddon
2021-06-11The RecordCatalin Cimpanu
@online{cimpanu:20210611:cybercrime:dba57e7, author = {Catalin Cimpanu}, title = {{Cybercrime Featured Avaddon ransomware operation shuts down and releases decryption keys}}, date = {2021-06-11}, organization = {The Record}, url = {https://therecord.media/avaddon-ransomware-operation-shuts-down-and-releases-decryption-keys/}, language = {English}, urldate = {2021-06-21} } Cybercrime Featured Avaddon ransomware operation shuts down and releases decryption keys
Avaddon
2021-06-07ATOSLoïc Castel
@online{castel:20210607:avaddon:9a4a8cb, author = {Loïc Castel}, title = {{Avaddon Ransomware Analysis}}, date = {2021-06-07}, organization = {ATOS}, url = {https://atos.net/en/lp/securitydive/avaddon-ransomware-analysis}, language = {English}, urldate = {2021-11-17} } Avaddon Ransomware Analysis
Avaddon
2021-05-14The RecordCatalin Cimpanu
@online{cimpanu:20210514:darkside:2760169, author = {Catalin Cimpanu}, title = {{Darkside ransomware gang says it lost control of its servers & money a day after Biden threat}}, date = {2021-05-14}, organization = {The Record}, url = {https://therecord.media/darkside-ransomware-gang-says-it-lost-control-of-its-servers-money-a-day-after-biden-threat/}, language = {English}, urldate = {2021-05-17} } Darkside ransomware gang says it lost control of its servers & money a day after Biden threat
DarkSide Avaddon REvil
2021-05-10DarkTracerDarkTracer
@online{darktracer:20210510:intelligence:b9d1c3f, author = {DarkTracer}, title = {{Intelligence Report on Ransomware Gangs on the DarkWeb: List of victim organizations attacked by ransomware gangs released on the DarkWeb}}, date = {2021-05-10}, organization = {DarkTracer}, url = {https://docs.google.com/spreadsheets/d/1MI8Z2tBhmqQ5X8Wf_ozv3dVjz5sJOs-3}, language = {English}, urldate = {2021-05-13} } Intelligence Report on Ransomware Gangs on the DarkWeb: List of victim organizations attacked by ransomware gangs released on the DarkWeb
RansomEXX Avaddon Babuk Clop Conti Cuba DarkSide DoppelPaymer Egregor Hades LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker Nefilim Nemty Pay2Key PwndLocker RagnarLocker Ragnarok RansomEXX REvil Sekhmet SunCrypt ThunderX
2021-05-08Australian Signals DirectorateAustralian Cyber Security Centre (ACSC)
@techreport{acsc:20210508:2021003:ac0c913, author = {Australian Cyber Security Centre (ACSC)}, title = {{2021-003: Ongoing campaign using Avaddon Ransomware}}, date = {2021-05-08}, institution = {Australian Signals Directorate}, url = {https://www.cyber.gov.au/sites/default/files/2021-05/2021-003%20Ongoing%20campaign%20using%20Avaddon%20Ransomware%20-%2020210508.pdf}, language = {English}, urldate = {2021-05-11} } 2021-003: Ongoing campaign using Avaddon Ransomware
Avaddon
2021-05-06Cyborg SecurityBrandon Denker
@online{denker:20210506:ransomware:a1f31df, author = {Brandon Denker}, title = {{Ransomware: Hunting for Inhibiting System Backup or Recovery}}, date = {2021-05-06}, organization = {Cyborg Security}, url = {https://www.cyborgsecurity.com/cyborg_labs/hunting-ransomware-inhibiting-system-backup-or-recovery/}, language = {English}, urldate = {2021-05-08} } Ransomware: Hunting for Inhibiting System Backup or Recovery
Avaddon Conti DarkSide LockBit Mailto Maze Mespinoza Nemty PwndLocker RagnarLocker RansomEXX REvil Ryuk Snatch ThunderX
2021-04-26CoveWareCoveWare
@online{coveware:20210426:ransomware:12586d5, author = {CoveWare}, title = {{Ransomware Attack Vectors Shift as New Software Vulnerability Exploits Abound}}, date = {2021-04-26}, organization = {CoveWare}, url = {https://www.coveware.com/blog/ransomware-attack-vectors-shift-as-new-software-vulnerability-exploits-abound}, language = {English}, urldate = {2021-05-13} } Ransomware Attack Vectors Shift as New Software Vulnerability Exploits Abound
Avaddon Clop Conti DarkSide Egregor LockBit Mailto Phobos REvil Ryuk SunCrypt
2021-04-25Vulnerability.ch BlogCorsin Camichel
@online{camichel:20210425:ransomware:1a1ee7f, author = {Corsin Camichel}, title = {{Ransomware and Data Leak Site Publication Time Analysis}}, date = {2021-04-25}, organization = {Vulnerability.ch Blog}, url = {https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/}, language = {English}, urldate = {2021-04-29} } Ransomware and Data Leak Site Publication Time Analysis
Avaddon Babuk Clop Conti DarkSide DoppelPaymer Mespinoza Nefilim REvil
2021-04-01SentinelOneJim Walter
@online{walter:20210401:avaddon:6735c18, author = {Jim Walter}, title = {{Avaddon RaaS | Breaks Public Decryptor, Continues On Rampage}}, date = {2021-04-01}, organization = {SentinelOne}, url = {https://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage/}, language = {English}, urldate = {2021-04-09} } Avaddon RaaS | Breaks Public Decryptor, Continues On Rampage
Avaddon
2021-02-23CrowdStrikeCrowdStrike
@techreport{crowdstrike:20210223:2021:bf5bc4f, author = {CrowdStrike}, title = {{2021 Global Threat Report}}, date = {2021-02-23}, institution = {CrowdStrike}, url = {https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2021GTR.pdf}, language = {English}, urldate = {2021-02-25} } 2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader KNOCKOUT SPIDER OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER
2021-02-09Javier Yuste, Sergio Pastrana
@techreport{yuste:20210209:avaddon:1bc8c3b, author = {Javier Yuste and Sergio Pastrana}, title = {{Avaddon ransomware: an in-depth analysis and decryption of infected systems}}, date = {2021-02-09}, institution = {}, url = {https://arxiv.org/pdf/2102.04796.pdf}, language = {English}, urldate = {2021-02-26} } Avaddon ransomware: an in-depth analysis and decryption of infected systems
Avaddon
2021-02-02CRONUPGermán Fernández
@online{fernndez:20210202:de:6ff4f3a, author = {Germán Fernández}, title = {{De ataque con Malware a incidente de Ransomware}}, date = {2021-02-02}, organization = {CRONUP}, url = {https://www.cronup.com/post/de-ataque-con-malware-a-incidente-de-ransomware}, language = {Spanish}, urldate = {2021-03-02} } De ataque con Malware a incidente de Ransomware
Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DanaBot Dharma Dridex Egregor Emotet Empire Downloader FriedEx GootKit IcedID MegaCortex Nemty Phorpiex PwndLocker PyXie QakBot RansomEXX REvil Ryuk SDBbot SmokeLoader TrickBot Zloader
2021-01-26Medium s2wlabHyunmin Suh
@online{suh:20210126:w4:138a143, author = {Hyunmin Suh}, title = {{W4 Jan | EN | Story of the week: Ransomware on the Darkweb}}, date = {2021-01-26}, organization = {Medium s2wlab}, url = {https://medium.com/s2wlab/w4-jan-en-story-of-the-week-ransomware-on-the-darkweb-7595544363b1}, language = {English}, urldate = {2021-01-27} } W4 Jan | EN | Story of the week: Ransomware on the Darkweb
Avaddon Babuk LockBit
2021-01-24Bleeping ComputerLawrence Abrams
@online{abrams:20210124:another:23e31f7, author = {Lawrence Abrams}, title = {{Another ransomware (Avaddon) now uses DDoS attacks to force victims to pay}}, date = {2021-01-24}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/another-ransomware-now-uses-ddos-attacks-to-force-victims-to-pay/}, language = {English}, urldate = {2021-01-25} } Another ransomware (Avaddon) now uses DDoS attacks to force victims to pay
Avaddon
2021-01-11Twitter (@dk_samper)Dávid Kosť
@online{kos:20210111:initial:cfb0867, author = {Dávid Kosť}, title = {{Tweet on Initial access of Avaddon Ransomware group from an IR engagement}}, date = {2021-01-11}, organization = {Twitter (@dk_samper)}, url = {https://twitter.com/dk_samper/status/1348560784285167617}, language = {English}, urldate = {2021-01-21} } Tweet on Initial access of Avaddon Ransomware group from an IR engagement
Avaddon
2020-12-28SwanscanSwascan Cyber Incident Response Team, Pierguido Iezzi
@online{team:20201228:avaddon:df83aad, author = {Swascan Cyber Incident Response Team and Pierguido Iezzi}, title = {{Avaddon Ransomware: Incident Response Analysis}}, date = {2020-12-28}, organization = {Swanscan}, url = {https://www.swascan.com/it/avaddon-ransomware/}, language = {Italian}, urldate = {2021-01-21} } Avaddon Ransomware: Incident Response Analysis
Avaddon
2020-11-20ZDNetCatalin Cimpanu
@online{cimpanu:20201120:malware:0b8ff59, author = {Catalin Cimpanu}, title = {{The malware that usually installs ransomware and you need to remove right away}}, date = {2020-11-20}, organization = {ZDNet}, url = {https://www.zdnet.com/article/the-malware-that-usually-installs-ransomware-and-you-need-to-remove-right-away/}, language = {English}, urldate = {2020-11-23} } The malware that usually installs ransomware and you need to remove right away
Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DoppelPaymer Dridex Egregor Emotet FriedEx MegaCortex Phorpiex PwndLocker QakBot Ryuk SDBbot TrickBot Zloader
2020-11-16Intel 471Intel 471
@online{471:20201116:ransomwareasaservice:11a5a8b, author = {Intel 471}, title = {{Ransomware-as-a-service: The pandemic within a pandemic}}, date = {2020-11-16}, organization = {Intel 471}, url = {https://public.intel471.com/blog/ransomware-as-a-service-2020-ryuk-maze-revil-egregor-doppelpaymer/}, language = {English}, urldate = {2020-11-17} } Ransomware-as-a-service: The pandemic within a pandemic
Avaddon Clop Conti DoppelPaymer Egregor Hakbit Mailto Maze Mespinoza RagnarLocker REvil Ryuk SunCrypt ThunderX
2020-10-26AWAKEAshish Gahlot
@online{gahlot:20201026:threat:7eeb763, author = {Ashish Gahlot}, title = {{Threat Hunting for Avaddon Ransomware}}, date = {2020-10-26}, organization = {AWAKE}, url = {https://awakesecurity.com/blog/threat-hunting-for-avaddon-ransomware/}, language = {English}, urldate = {2020-11-02} } Threat Hunting for Avaddon Ransomware
Avaddon
2020-10-23HornetsecurityHornetsecurity Security Lab
@online{lab:20201023:leakwareransomwarehybrid:ae1de8e, author = {Hornetsecurity Security Lab}, title = {{Leakware-Ransomware-Hybrid Attacks}}, date = {2020-10-23}, organization = {Hornetsecurity}, url = {https://www.hornetsecurity.com/en/security-informationen-en/leakware-ransomware-hybrid-attacks/}, language = {English}, urldate = {2020-12-08} } Leakware-Ransomware-Hybrid Attacks
Avaddon Clop Conti DarkSide DoppelPaymer Mailto Maze Mespinoza Nefilim RagnarLocker REvil Sekhmet SunCrypt
2020-09-29PWC UKAndy Auld
@online{auld:20200929:whats:2782a62, author = {Andy Auld}, title = {{What's behind the increase in ransomware attacks this year?}}, date = {2020-09-29}, organization = {PWC UK}, url = {https://www.pwc.co.uk/issues/cyber-security-services/insights/what-is-behind-ransomware-attacks-increase.html}, language = {English}, urldate = {2021-05-25} } What's behind the increase in ransomware attacks this year?
DarkSide Avaddon Clop Conti DoppelPaymer Dridex Emotet FriedEx Mailto PwndLocker QakBot REvil Ryuk SMAUG SunCrypt TrickBot WastedLocker
2020-08-25KELAVictoria Kivilevich
@online{kivilevich:20200825:how:5db6a82, author = {Victoria Kivilevich}, title = {{How Ransomware Gangs Find New Monetization Schemes and Evolve in Marketing}}, date = {2020-08-25}, organization = {KELA}, url = {https://ke-la.com/how-ransomware-gangs-find-new-monetization-schemes-and-evolve-in-marketing/}, language = {English}, urldate = {2021-05-07} } How Ransomware Gangs Find New Monetization Schemes and Evolve in Marketing
Avaddon Clop DarkSide DoppelPaymer Mailto Maze MedusaLocker Mespinoza Nefilim RagnarLocker REvil Sekhmet
2020-07-08Trend MicroTrend Micro Threat Research Team
@online{team:20200708:ransomware:90c8636, author = {Trend Micro Threat Research Team}, title = {{Ransomware Report: Avaddon and New Techniques Emerge, Industrial Sector Targeted}}, date = {2020-07-08}, organization = {Trend Micro}, url = {https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted}, language = {English}, urldate = {2020-07-30} } Ransomware Report: Avaddon and New Techniques Emerge, Industrial Sector Targeted
Avaddon
2020-07-01TG SoftTG Soft
@online{soft:20200701:cyberthreat:45d22d9, author = {TG Soft}, title = {{Cyber-Threat Report on the cyber attacks of June 2020 in Italy}}, date = {2020-07-01}, organization = {TG Soft}, url = {https://www.tgsoft.it/files/report/download.asp?id=568531345}, language = {Italian}, urldate = {2020-07-30} } Cyber-Threat Report on the cyber attacks of June 2020 in Italy
Avaddon ISFB
2020-06-12ThreatConnectThreatConnect Research Team
@online{team:20200612:probable:89a5bed, author = {ThreatConnect Research Team}, title = {{Probable Sandworm Infrastructure}}, date = {2020-06-12}, organization = {ThreatConnect}, url = {https://threatconnect.com/blog/threatconnect-research-roundup-probable-sandworm-infrastructure}, language = {English}, urldate = {2020-06-16} } Probable Sandworm Infrastructure
Avaddon Emotet Kimsuky
2020-06-11Twitter (@Securityinbits)Security-in-Bits
@online{securityinbits:20200611:avaddon:b50486e, author = {Security-in-Bits}, title = {{Tweet on Avaddon ransomware with Python script for decrypting strings}}, date = {2020-06-11}, organization = {Twitter (@Securityinbits)}, url = {https://twitter.com/Securityinbits/status/1271065316903120902}, language = {English}, urldate = {2020-06-12} } Tweet on Avaddon ransomware with Python script for decrypting strings
Avaddon
2020-06-05HornetsecuritySecurity Lab
@online{lab:20200605:avaddon:399af6f, author = {Security Lab}, title = {{Avaddon: From seeking affiliates to in-the-wild in 2 days}}, date = {2020-06-05}, organization = {Hornetsecurity}, url = {https://www.hornetsecurity.com/en/security-information/avaddon-from-seeking-affiliates-to-in-the-wild-in-2-days/}, language = {English}, urldate = {2020-06-08} } Avaddon: From seeking affiliates to in-the-wild in 2 days
Avaddon
2020-05-31ESET ResearchFacundo Muñoz
@online{muoz:20200531:ransomware:3549ba1, author = {Facundo Muñoz}, title = {{Ransomware Avaddon: principales características}}, date = {2020-05-31}, organization = {ESET Research}, url = {https://www.welivesecurity.com/la-es/2021/05/31/ransomware-avaddon-principales-caracteristicas/}, language = {Spanish}, urldate = {2021-06-09} } Ransomware Avaddon: principales características
Avaddon
Yara Rules
[TLP:WHITE] win_avaddon_auto (20230125 | Detects win.avaddon.)
rule win_avaddon_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.avaddon."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avaddon"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8d5248 c7428c00000000 33c0 0f1041d4 0f1106 f30f7e41e4 660fd64610 }
            // n = 7, score = 200
            //   8d5248               | lea                 edx, [edx + 0x48]
            //   c7428c00000000       | mov                 dword ptr [edx - 0x74], 0
            //   33c0                 | xor                 eax, eax
            //   0f1041d4             | movups              xmm0, xmmword ptr [ecx - 0x2c]
            //   0f1106               | movups              xmmword ptr [esi], xmm0
            //   f30f7e41e4           | movq                xmm0, qword ptr [ecx - 0x1c]
            //   660fd64610           | movq                qword ptr [esi + 0x10], xmm0

        $sequence_1 = { bb07000000 8bc7 0f1107 894f10 895f14 5f }
            // n = 6, score = 200
            //   bb07000000           | mov                 ebx, 7
            //   8bc7                 | mov                 eax, edi
            //   0f1107               | movups              xmmword ptr [edi], xmm0
            //   894f10               | mov                 dword ptr [edi + 0x10], ecx
            //   895f14               | mov                 dword ptr [edi + 0x14], ebx
            //   5f                   | pop                 edi

        $sequence_2 = { 8b4304 47 0fafc7 8bf2 33d2 f7f1 }
            // n = 6, score = 200
            //   8b4304               | mov                 eax, dword ptr [ebx + 4]
            //   47                   | inc                 edi
            //   0fafc7               | imul                eax, edi
            //   8bf2                 | mov                 esi, edx
            //   33d2                 | xor                 edx, edx
            //   f7f1                 | div                 ecx

        $sequence_3 = { c7461400000000 0f1106 f30f7e45e8 660fd64610 8b4df4 64890d00000000 59 }
            // n = 7, score = 200
            //   c7461400000000       | mov                 dword ptr [esi + 0x14], 0
            //   0f1106               | movups              xmmword ptr [esi], xmm0
            //   f30f7e45e8           | movq                xmm0, qword ptr [ebp - 0x18]
            //   660fd64610           | movq                qword ptr [esi + 0x10], xmm0
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx
            //   59                   | pop                 ecx

        $sequence_4 = { e8???????? 83c404 894614 57 ff7314 50 e8???????? }
            // n = 7, score = 200
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   894614               | mov                 dword ptr [esi + 0x14], eax
            //   57                   | push                edi
            //   ff7314               | push                dword ptr [ebx + 0x14]
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_5 = { 2bce 57 8bfa 8975fc c1ef1f 03fa f7e9 }
            // n = 7, score = 200
            //   2bce                 | sub                 ecx, esi
            //   57                   | push                edi
            //   8bfa                 | mov                 edi, edx
            //   8975fc               | mov                 dword ptr [ebp - 4], esi
            //   c1ef1f               | shr                 edi, 0x1f
            //   03fa                 | add                 edi, edx
            //   f7e9                 | imul                ecx

        $sequence_6 = { 668946e8 8d4718 c745fc00000000 3bc6 7435 8b08 85c9 }
            // n = 7, score = 200
            //   668946e8             | mov                 word ptr [esi - 0x18], ax
            //   8d4718               | lea                 eax, [edi + 0x18]
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   3bc6                 | cmp                 eax, esi
            //   7435                 | je                  0x37
            //   8b08                 | mov                 ecx, dword ptr [eax]
            //   85c9                 | test                ecx, ecx

        $sequence_7 = { 83c404 8b55cc 8b45b8 8b5d0c 40 8945b8 3b45c4 }
            // n = 7, score = 200
            //   83c404               | add                 esp, 4
            //   8b55cc               | mov                 edx, dword ptr [ebp - 0x34]
            //   8b45b8               | mov                 eax, dword ptr [ebp - 0x48]
            //   8b5d0c               | mov                 ebx, dword ptr [ebp + 0xc]
            //   40                   | inc                 eax
            //   8945b8               | mov                 dword ptr [ebp - 0x48], eax
            //   3b45c4               | cmp                 eax, dword ptr [ebp - 0x3c]

        $sequence_8 = { 3b7dd4 0f94c0 03c1 8d4da4 50 52 e8???????? }
            // n = 7, score = 200
            //   3b7dd4               | cmp                 edi, dword ptr [ebp - 0x2c]
            //   0f94c0               | sete                al
            //   03c1                 | add                 eax, ecx
            //   8d4da4               | lea                 ecx, [ebp - 0x5c]
            //   50                   | push                eax
            //   52                   | push                edx
            //   e8????????           |                     

        $sequence_9 = { 0fb6c0 50 ff5210 e9???????? 85f6 74a9 83cfff }
            // n = 7, score = 200
            //   0fb6c0               | movzx               eax, al
            //   50                   | push                eax
            //   ff5210               | call                dword ptr [edx + 0x10]
            //   e9????????           |                     
            //   85f6                 | test                esi, esi
            //   74a9                 | je                  0xffffffab
            //   83cfff               | or                  edi, 0xffffffff

    condition:
        7 of them and filesize < 2343936
}
[TLP:WHITE] win_avaddon_w0   (20200902 | Detects Avaddon ransomware)
rule win_avaddon_w0 {
    meta:
        description = "Detects Avaddon ransomware"
        author = "@VK_Intel, modified by @r0ny_123"
        reference = "https://twitter.com/VK_Intel/status/1300944441390370819"
        tlp = "white"
        date = "2020-09-01"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.avaddon"
        malpedia_rule_date = "20200902"
        malpedia_hash = ""
        malpedia_version = "20200902"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $str0 = "rcid"
        $str1 = "hdd"
        $str2 = "lang"
        $cfg_parser = { 55 8b ec 6a ff 68 74 d8 46 00 64 ?? ?? ?? ?? ?? 50 81 ec 3c 02 00 00 a1 ?? ?? ?? ?? 33 c5 89 ?? ?? 56 57 50 8d ?? ?? 64 ?? ?? ?? ?? ?? 8b f1 89 ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c6 ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 8b ?? 51 8b ce ff ?? ?? 83 ?? ?? ?? ?? ?? ?? 0f ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? 8d ?? ?? e8 ?? ?? ?? ?? c6 ?? ?? ?? 8b ?? ?? 85 c0 0f ?? ?? ?? ?? ?? b9 10 00 00 00 c7 ?? ?? ?? ?? ?? ?? 3b c1 c7 ?? ?? ?? ?? ?? ?? c6 ?? ?? ?? 0f 42 c8 83 ?? ?? ?? 8d ?? ?? 0f ?? ?? ?? 51 50 8d ?? ?? e8 ?? ?? ?? ?? c6 ?? ?? ?? 8b ?? ?? c7 ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? c6 ?? ?? ?? 83 f8 10 0f ?? ?? ?? ?? ?? 83 c0 f0 b9 20 00 00 00 3b c1 0f 42 c8 83 ?? ?? ?? 8d ?? ?? 0f ?? ?? ?? 51 83 c0 10 8d ?? ?? 50 e8 ?? ?? ?? ?? c6 ?? ?? ?? 83 ?? ?? ?? 0f ?? ?? ?? ?? ?? 83 ?? ?? ?? 0f ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c6 ?? ?? ?? 8d ?? ?? ?? ?? ?? 8b ?? 51 8b ce ff ?? ?? 8b ?? ?? ?? ?? ?? 8d ?? ?? ?? ?? ?? e8 ?? ?? ?? ?? 0f ?? ?? ?? ?? ?? ?? 0f ?? ?? ?? ?? ?? ?? f3 ?? ?? ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ?? c7 ?? ?? ?? ?? ?? ?? ?? ?? ??}
        $crypt_imp_seq_0 = { 83 ?? ?? ?? 8b c7 c7 ?? ?? ?? ?? ?? ?? 72 ?? 8b ?? 6a 00 6a 00 8d ?? ?? 51 6a 00 6a 01 6a 00 50 ff ?? ?? ?? ?? ?? 85 c0 [3-6] 8b ?? ?? ff ?? ?? ?? ?? ?? 56 6a 00 50 ff ?? ?? ?? ?? ?? 8b f0 85 f6 [2-6] 83 ?? ?? ?? 72 ?? 8b ?? 6a 00 6a 00 8d ?? ?? 50 56 6a 01 6a 00 57 ff ?? ?? ?? ?? ?? 85 c0 74 ?? [0-3] 8d ?? ?? 50 6a 00 6a 00 ff ?? ?? 56 ff ?? ?? ff ?? ?? ?? ?? ?? }
    condition:
        uint16(0) == 0x5a4d and 1 of ($str*) and ($cfg_parser or $crypt_imp_seq_0)
}
Download all Yara Rules