user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Ransom:Win32/Avaddon.P!MSR
Ransom:Win32/Avaddon.P!MSR - Windows Defender threat signature analysis

Ransom:Win32/Avaddon.P!MSR - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Ransom:Win32/Avaddon.P!MSR
Classification:
Type:Ransom
Platform:Win32
Family:Avaddon
Detection Type:Concrete
Known malware family with identified signatures
Variant:P
Specific signature variant within the malware family
Suffix:!MSR
High-priority threat flagged by Microsoft Security Response
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Ransomware - Encrypts files and demands payment for 32-bit Windows platform, family Avaddon

Summary:

Ransom:Win32/Avaddon.P!MSR is a concrete detection for the Avaddon ransomware, a critical threat that encrypts a victim's files and demands a ransom for their decryption. It typically drops a ransom note (e.g., read_me_lock.txt) instructing users to use the Tor browser to access .onion sites for payment, and attempts to delete shadow copies to hinder recovery.

Severity:
Critical
VDM Static Detection:
Relevant strings associated with this threat:
 - /Your network has been infected by <span>Avaddon (PEHSTR)
 - have been <b>encrypted (PEHSTR)
 - Avaddon General Decryptor (PEHSTR)
 - 1\BIN\%s.exe (PEHSTR)
 - \XMedCon\bin\medcon.exe (PEHSTR)
 - P?% (SNID)
 - your files have been encrypted (PEHSTR)
 - .onion (PEHSTR)
 - read_me_lock.txt (PEHSTR)
YARA Rule:
rule Ransom_Win32_Avaddon_P_2147783567_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "Ransom:Win32/Avaddon.P!MSR"
        threat_id = "2147783567"
        type = "Ransom"
        platform = "Win32: Windows 32-bit platform"
        family = "Avaddon"
        severity = "Critical"
        info = "MSR: Microsoft Security Response"
        signature_type = "SIGNATURE_TYPE_PEHSTR"
        threshold = "4"
        strings_accuracy = "High"
    strings:
        $x_2_1 = "your files have been encrypted" ascii //weight: 2
        $x_1_2 = ".onion" ascii //weight: 1
        $x_1_3 = "Tor browser" ascii //weight: 1
        $x_2_4 = "read_me_lock.txt" ascii //weight: 2
        $x_1_5 = "C:\\Users\\lock.txt" wide //weight: 1
        $x_1_6 = "Win32_ShadowCopy.ID='%s'" wide //weight: 1
    condition:
        (filesize < 20MB) and
        (
            ((4 of ($x_1_*))) or
            ((1 of ($x_2_*) and 2 of ($x_1_*))) or
            ((2 of ($x_2_*))) or
            (all of ($x*))
        )
}
Known malware which is associated with this threat:
Filename: 12bba7161d07efcb1b14d30054901ac9ffe5202972437b0c47c88d71e45c7176
12bba7161d07efcb1b14d30054901ac9ffe5202972437b0c47c88d71e45c7176
31/01/2026
→VirusTotal↓Download Sample
Remediation Steps:
Immediately isolate affected systems to prevent further spread. Use an updated antivirus solution to remove the ransomware. Restore encrypted files from secure, offline backups. Implement robust security hygiene, including regular patching, strong endpoint protection, and network segmentation, to prevent future infections.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 31/01/2026. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊