Avaddon Ransomware (.<9~10-Digit Random Extension> / <1~5-Digit Random>_readme.html) - Videos - CheckMAL

Videos

Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

Distribution Method : Automatic infection using exploit by visiting website

MD5 : 701eeee25d9b52ce9940c2bb1081a4d9

Encrypted File Pattern : .<9~10-Digit Random Extension>

Malicious File Creation Location : C:\Users\%UserName%\AppData\Local\Temp\<Random>.exe

Payment Instruction File : <1~5-Digit Random>_readme.html

Major Characteristics :
- Offline Encryption
- Turns off User Access Control (UAC)
- EFI System Partition (X:\) and Recovery Partition (Y:\) drives are activate.
- Block processes execution (360doctor.exe, httpd.exe, sqlbrowser.exe, supervise.exe, tomcat6.exe, winword.exe etc.)
- Disable system restore (wmic.exe SHADOWCOPY /nointeractive, vssadmin.exe Delete Shadows /All /Quiet, bcdedit.exe /set {default} recoveryenabled No)