Avaddon
Avaddon is a ransomware malware targeting Windows systems often spread via malicious spam. The first known attack where Avaddon ransomware was distributed was in February 2020. Avaddon encrypts files using the extension .avdn and uses a TOR payment site for the ransom payment.
Victims
146
First Discovered
2021-02-01
victim
Last Discovered
2021-09-09
victim
Inactive Since
4yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
0.0%
victims with domain
Countries
3
hit
Known Locations (1)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
No | 2026-04-28T07:21:38 |
avaddongun7rngel.onion
|
Target
Top 5 Activity Sectors
- Manufacturing 25
- Business Services 24
- Public Sector 12
- Financial Services 11
- Technology 10
Top 5 Countries
-
United States
5
-
Canada
1
-
Australia
1
Heatmap
Ransom Notes (1)
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
SoftPerfect NetScan
|
|
GMER
PowerTool
TDSSKiller
|
Mimikatz
SharpDump
|
PowerShell Empire
PowerSploit
|
|
|
Anonfiles
MEGA
ProtonMail
Sendspace
|
Negotiation Chats (7)
20210112
25 msgs
20210324
73 msgs
20210430
103 msgs
20210512
35 msgs
20210518
17 msgs
20210518_2
24 msgs
20210518_3
103 msgs
YARA Rules (1)
Victims (146)
