Videos
Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.
- Distribution Method : Automatic infection using exploit by visiting website
- MD5 : c83f30c065f7f61428eac2370ddb4f53
- Major Detection Name : Trojan.Ransom.Avaddon (ALYac), TR/AD.AvaddonRansom.lcu (Avira)
- Encrypted File Pattern : .1F2jJ
- Malicious File Creation Location : C:\Users\%UserName%\AppData\Roaming\Microsoft\<Random>.exe
- Payment Instruction File : readme.html
- Major Characteristics :
- Offline Encryption
- Turns off User Access Control (UAC)
- EFI System Partition (X:\) and Recovery Partition (Y:\) drives are activate.
- Block processes execution (qbupdate.exe, sqlmangr.exe, sqlservr.exe, supervise.exe, winword.exe, wxServer.exe etc.)
- Disable system restore (wmic.exe SHADOWCOPY /nointeractive, vssadmin.exe Delete Shadows /All /Quiet)
- Adds update to scheduler to execute "%AppData%\Microsoft\<Random>.exe" Every 10 minutes