Publication:
Avaddon ransomware: An in-depth analysis and decryption of infected systems

Simple item page
carlosiii.embargo.terms2023-10-01
dc.affiliation.dptoUC3M. Departamento de Informáticaes
dc.affiliation.grupoinvUC3M. Grupo de Investigación: COSEC (Computer SECurity Lab)es
dc.contributor.authorYuste, Javier
dc.contributor.authorPastrana Portillo, Sergio
dc.contributor.funderComunidad de Madrides
dc.contributor.funderMinisterio de Ciencia, Innovación y Universidades (España)es
dc.date.accessioned2022-01-11T12:57:40Z
dc.date.available2023-10-01T23:00:05Z
dc.date.issued2021-10
dc.description.abstractMalware is an emerging and popular threat flourishing in the underground economy. The commoditization of Malware-as-a-Service (MaaS) allows criminals to obtain financial benefits at a low risk and with little technical background. One such popular product is ransomware, which is a popular type of malware traded in the underground economy. In ransomware attacks, data from infected systems is held hostage (encrypted) until a ransom is paid to the criminals. In addition, a recent blackmailing strategy adopted by criminals is to leak data online from the infected systems if the ransom is not paid before a given time, producing further economic and reputational damage. In this work, we perform an in-depth analysis of Avaddon, a ransomware offered in the underground economy as an affiliate program business. This threat has been linked to various cyberattacks and has infected and leaked data from at least 62 organizations. Additionally, it also runs Distributed Denial-of-Service (DDoS) attacks against victims that do not pay the ransom. We first provide an analysis of the criminal business model in the underground economy. Then, we identify and describe its technical capabilities, dissecting details of its inner structure. As a result, we provide tools to assist analysis, decrypting and labeling obfuscated strings observed in the ransomware binary. Additionally, we provide empirical evidence of links between this variant and a previous family, suggesting that the same group was behind the development and, possibly, the operation of both campaigns. Finally, we develop a procedure to recover files encrypted by Avaddon. We successfully tested the proposed procedure against different versions of Avaddon. The proposed method is released as an open-source tool so it can be incorporated in existing Antivirus engines and extended to decrypt other ransomware families that implement a similar encryption approach.en
dc.description.sponsorshipWe thank the anonymous reviewers for their valuable comments. This work was supported by the Spanish grants ODIO (PID2019-111429RB-C21 and PID2019-111429RB), the Ministerio de Ciencia, Innovación y Universidades (Ref. PGC2018-095322-B-C22) and by the Region of Madrid grants CYNAMON-CM (P2018/TCS-4566), co-financed by European Structural Funds ESF and FEDER, and Excellence Program EPUC3M17. The opinions, findings, and conclusions or recommendations expressed are those of the authors and do not necessarily reflect those of any of the funders.en
dc.format.extent20
dc.identifier.bibliographicCitationYuste, J. & Pastrana, S. (2021). Avaddon ransomware: An in-depth analysis and decryption of infected systems. Computers & Security, 109, 102388.en
dc.identifier.doihttps://doi.org/10.1016/j.cose.2021.102388
dc.identifier.issn0167-4048
dc.identifier.publicationfirstpage1
dc.identifier.publicationissue102388
dc.identifier.publicationlastpage20
dc.identifier.publicationtitleComputers & Securityen
dc.identifier.publicationvolume109
dc.identifier.urihttps://hdl.handle.net/10016/33861
dc.identifier.uxxiAR/0000028977
dc.language.isoengen
dc.publisherElsevieren
dc.relation.projectIDGobierno de España. PID2019-111429RB-C21es
dc.relation.projectIDGobierno de España. PID2019-111429RBes
dc.relation.projectIDGobierno de España. PGC2018-095322-B-C22es
dc.relation.projectIDComunidad de Madrid. P2018/TCS-4566es
dc.rights© 2021 Elsevier Ltd. All rights reserved.en
dc.rightsAtribución-NoComercial-SinDerivadas 3.0 España*
dc.rights.accessRightsopen accessen
dc.rights.urihttp://creativecommons.org/licenses/by-nc-nd/3.0/es/*
dc.subject.ecienciaInformáticaes
dc.subject.otherAvaddonen
dc.subject.otherRansomwareen
dc.subject.otherMalware analysisen
dc.subject.otherReverse engineeringen
dc.subject.otherCybersecurityen
dc.titleAvaddon ransomware: An in-depth analysis and decryption of infected systemsen
dc.typeresearch article*
dc.type.hasVersionAM*
dspace.entity.typePublication
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
Avaddon_COSE_2021_ps.pdf
Size:
828.86 KB
Format:
Adobe Portable Document Format
Download
Collections
DI - COSEC - Artículos de Revistas