24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 68:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom.Avaddon.Generic Sample 1228d0f04f0b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1228d0f04f0b…. Malware family: Ransom.Avaddon.Generic. Threat score 100/100. 23/27 AV engines flagged this file. 16 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1228d0f04f0ba82569fc1c0609f9fd6c377a91b9ea44c1e7f9f84b2b90552da2","keywords":["Malicious","Ransom.Avaddon.Generic","malware analysis","sandbox report","threat intelligence","1228d0f04f0ba82569fc1c0609f9fd6c377a91b9ea44c1e7f9f84b2b90552da2"],"about":{"@type":"SoftwareApplication","name":"ab.bin","applicationCategory":["peexe","executable"],"identifier":"1228d0f04f0ba82569fc1c0609f9fd6c377a91b9ea44c1e7f9f84b2b90552da2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom.Avaddon.Generic","antivirusDetections":{"malicious":23,"total":27},"behavioralIndicators":{"malicious":16,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T80a,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ab.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "ab.bin") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "ab.bin") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "ab.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005436.00000000.67264.655C1000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005436.00000000.67264.655C1000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006992.00000000.67302.008FD000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp")26:Ta9c,Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "ab.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "ab.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "ab.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "ab.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "ab.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "ab.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.67264.655C1000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00005436.00000000.67264.655C1000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006992.00000000.67302.008FD000.00000002.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00006992.00000000.67302.72841000.00000020.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp")27:T99b,Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "ab.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "ab.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "ab.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "ab.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "ab.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp, 00000000-00001912.00000002.70894.72879000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp, 00000000-00001912.00000002.70894.72879000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001912.00000000.67056.00B74000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006992.00000000.67302.72191000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006992.00000000.67302.72191000.00000020.mdmp, 00000000-00006992.00000000.67302.72879000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006992.00000000.67302.72191000.00000020.mdmp, 00000000-00006992.00000000.67302.72879000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp")28:T6b5,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "ab.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "ab.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00001912.00000000.67056.00940000.00000004.mdmp, 00000000-00001912.00000000.67056.00B74000.00000002.mdmp, 00000000-00001912.00000001.68977.00940000.00000004.mdmp, 00000000-00001912.00000002.70894.00940000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00001912.00000000.67056.00940000.00000004.mdmp, 00000000-00001912.00000000.67056.00B74000.00000002.mdmp, 00000000-00001912.00000001.68977.00940000.00000004.mdmp, 00000000-00001912.00000002.70894.00940000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp, 00000000-00010196.00000000.70954.01380000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00010196.00000000.70954.007B4000.00000002.mdmp, 00000000-00010196.00000000.70954.01380000.00000004.mdmp")29:T6f9,"\" - Source: \"00000000-00006992.00000000.67302.72841000.00000020.mdmp\")\n Found URL \"https://www.torproject.org/\" - Source: \"00000000-00010196.00000000.70954.01380000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"65dcadbb1709821f590be8cb"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"$4c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"65dcadbb1709821f590be8cb"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking related APIs","description":"Observed import api \"WNetGetConnection\" which can \"retrieves the name of the network resource associated with a local device\" [Source: ab.bin]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"65dcadbb1709821f590be8cb"},{"report_type":"sandbox","report_id":"63525449a81164093338a03c"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"65dcadbb1709821f590be8cb"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"65dcadbb1709821f590be8cb"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"$4d","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"65dcadbb1709821f590be8cb"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"ab.bin\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00001912.00000000.67056.00B74000.00000002.mdmp\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00010196.00000000.70954.007B4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"65dcadbb1709821f590be8cb"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"Empties the Recycle Bin on the specified drive\" [Source: ab.bin]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"65dcadbb1709821f590be8cb"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"65dcadbb1709821f590be8cb"}]},{"level":"informative","category":"Remote Access Related","name":"Observed Microsoft Internet Information Services [IIS] related strings in binary/memory","description":"Found string -%PROGRAMFILES%\\Microsoft\\Exchange Server\\*Indicator: \\microsoft\\exchange server\\\n Found string -%PROGRAMFILES%\\(x86)\\Microsoft\\Exchange Server\\*Indicator: \\microsoft\\exchange server\\","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-130","sources":[{"report_type":"sandbox","report_id":"65dcadbb1709821f590be8cb"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"65dcadbb1709821f590be8cb"},{"report_type":"sandbox","report_id":"63525449a81164093338a03c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"