Ransom

Ransom.Avaddon (file analysis)

Malware Removal

The Ransom.Avaddon is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Ransom.Avaddon virus can do?

  • Attempts to connect to a dead IP:Port (1 unique times)
  • A process attempted to delay the analysis task.
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • A process created a hidden window
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Russian
  • Creates an autorun.inf file
  • Uses Windows utilities for basic functionality
  • Attempts to delete volume shadow copies
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Modifies boot configuration settings
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Attempts to modify proxy settings
  • Clears Windows events or logs
  • Creates a copy of itself
  • Attempts to disable UAC
  • Attempts to modify UAC prompt behavior
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
a.tomx.xyz
api.myip.com
ocsp.digicert.com
crl3.digicert.com
crl4.digicert.com

How to determine Ransom.Avaddon?


File Info:

crc32: 9357FCA8
md5: 2e9ccb2e30eea85465318b373edcf948
name: 781208537.exe
sha1: f1a216c6933010fabacc59c3018ff045fea4410e
sha256: 4a072c044993616658d1fdeddcf9ead501633fdf000cde18447301afa9b96e99
sha512: 89ce38c23c0994bfa5301d26b85f9b0be97ed97928f281c47b30c6bcfa3cc0181014d2fdd57ec46f24c7ebbb41616dd6ccd90189a507d0585ca44ddc9d23bc92
ssdeep: 24576:Bu13Ii3FoHjrdVIxpxJbpvR+h8O+DB8lllMOHnbbbbpcQs:Bu3IDHjrdVIxpxhe8O68Ll3bbbbpcQ
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: taskhost.exe
FileVersion: 10.0.17763.831 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 10.0.17763.831
FileDescription: Host Process for Windows Tasks
OriginalFilename: taskhost.exe
Translation: 0x0409 0x04b0

Ransom.Avaddon also known as:

BkavW32.AIDetectVM.malware1
MicroWorld-eScanTrojan.GenericKD.43370377
FireEyeGeneric.mg.2e9ccb2e30eea854
CAT-QuickHealTrojan.CKGENERIC
McAfeeGenericRXAA-AA!2E9CCB2E30EE
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
SangforMalware
K7AntiVirusTrojan ( 005690961 )
BitDefenderTrojan.GenericKD.43370377
K7GWTrojan ( 005690961 )
CrowdStrikewin/malicious_confidence_60% (W)
TrendMicroRansom_Avaddon.R002C0DFL20
BitDefenderThetaGen:NN.ZexaF.34130.aw3@aS6VvHpc
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Filecoder.Avaddon.A
APEXMalicious
Paloaltogeneric.ml
GDataTrojan.GenericKD.43370377
KasperskyHEUR:Trojan.Win32.Generic
AlibabaRansom:Win32/Avaddon.873938fc
ViRobotTrojan.Win32.Ransom.1143514
TencentWin32.Trojan.Filecoder.Huqe
SophosMal/Generic-S
ComodoMalware@#wjfanhfkfp2r
F-SecureTrojan.TR/AD.AvaddonRansom.pgzbl
DrWebTrojan.Siggen9.55346
EmsisoftTrojan.GenericKD.43370377 (B)
SentinelOneDFI – Suspicious PE
CyrenW32/Trojan.UKWQ-3098
JiangminTrojan.Generic.fnatr
AviraTR/AD.AvaddonRansom.pgzbl
MAXmalware (ai score=100)
Antiy-AVLTrojan[Ransom]/Win32.Avaddon
MicrosoftRansom:Win32/Avaddon.AA!MTB
ArcabitTrojan.Generic.D295C789
AegisLabTrojan.Win32.Generic.4!c
AhnLab-V3Malware/Win32.RL_Generic.R341088
ZoneAlarmHEUR:Trojan.Win32.Generic
CynetMalicious (score: 85)
VBA32TrojanRansom.Avaddon
ALYacTrojan.Ransom.Avaddon
Ad-AwareTrojan.GenericKD.43370377
MalwarebytesRansom.Avaddon
PandaTrj/GdSda.A
TrendMicro-HouseCallRansom_Avaddon.R002C0DFL20
RisingRansom.Avaddon!1.C7A8 (CLOUD)
YandexTrojan.Filecoder!1KEB5MW0odA
IkarusTrojan-Ransom.Avaddon
eGambitUnsafe.AI_Score_95%
FortinetW32/Filecoder_Avaddon.A!tr.ransom
AVGWin32:TrojanX-gen [Trj]
AvastWin32:TrojanX-gen [Trj]
Qihoo-360Win32/Trojan.fc8

How to remove Ransom.Avaddon?

Ransom.Avaddon removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment