Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

Avaddon Ransomware (.1F2jJ / readme.html)

  • Distribution Method : Automatic infection using exploit by visiting website
  • MD5 : c83f30c065f7f61428eac2370ddb4f53
  • Major Detection Name : Trojan.Ransom.Avaddon (ALYac), TR/AD.AvaddonRansom.lcu (Avira)
  • Encrypted File Pattern : .1F2jJ
  • Malicious File Creation Location : C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>.exe
  • Payment Instruction File : readme.html
  • Major Characteristics :
     - Offline Encryption
     - Turns off User Access Control (UAC)
     - EFI System Partition (X:\) and Recovery Partition (Y:\) drives are activate.
     - Block processes execution (qbupdate.exe, sqlmangr.exe, sqlservr.exe, supervise.exe, winword.exe, wxServer.exe etc.)
     - Disable system restore (wmic.exe SHADOWCOPY /nointeractive, vssadmin.exe Delete Shadows /All /Quiet)
     - Adds update to scheduler to execute "%AppData%\Microsoft\<Random>.exe" Every 10 minutes