--- title: Avaddon ransomware cleans the bin for you description: Avaddon is a new Maze-like ransomware that not only encrypts the user’s data but also steals it and threatens to make it public. Find out how to battle against it with Acronis Cyber Protection Solutions. canonical_url: https://www.acronis.com/en/blog/posts/avaddon-ransomware/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Avaddon ransomware cleans the bin for you Avaddon is a new Maze-like ransomware that not only encrypts the user’s data but also steals it and threatens to make it public. To do that, the Avaddon operator recently launched their own data leak site, where they have already published data from Liberty Linehaul and U.S. Auto Parts Network, Inc. What makes this ransomware unique is the way it tries to delete backups. In addition to traditional removal of shadow copies of the user’s files, Avaddon also deletes system backups, disables automatic repair and recovery, and cleans the bin. To do that, it escalates privileges with UAC bypassing through CMSTPLUA COM interface exploitation. [Try Now](https://www.acronis.com/en/products/cloud/trial/) [![Image 2: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png)](https://www.acronis.com/en/blog/authors/acronis/ "Acronis Editorial Team") [Acronis Editorial Team](https://www.acronis.com/en/blog/authors/acronis/) 9 min read Last updated 02 December 2022 Avaddon is a new Maze-like ransomware that not only encrypts the user’s data but also steals it and threatens to make it public. To do that, the Avaddon operator recently launched their own data leak site, where they have already published data from Liberty Linehaul and U.S. Auto Parts Network, Inc. What makes this ransomware unique is the way it tries to delete backups. In addition to traditional removal of shadow copies of the user’s files, Avaddon also deletes system backups, disables automatic repair and recovery, and cleans the bin. To do that, it escalates privileges with UAC bypassing through CMSTPLUA COM interface exploitation. ![Image 3: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/9415a0f5cb124c8638454659d0f87348.png) ### Summary * Attacks both regular users and organizations. * The ransom payment is $1,000, which is doubled if not paid in time. * The ransomware not only encrypts but also steals data to publish it later if the ransom is not paid. * Deletes not only shadow copies but system backups and files from the bin, before disabling automatic system restoration. * Does not encrypt files on the systems with a Russian default locale. * Exploits CMSTPLUA COM interface to bypass UAC. ### Ransomware delivery Avaddon ransomware is typically delivered through phishing emails that contain malicious attachments in the form of a zip archive with malicious JavaScript inside. ### Language check It’s common for malware to check the user’s locale before infecting the victim’s systems. Avaddon first checks the user’s default locale using the GetUserDefaultLCID() function. If it is Russian (ru-RU) or Cherokee (chr-Cher-US), it leaves the system without encrypting anything. Previously, Avaddon checked for a Ukrainian custom locale (uk-UA) instead of Cherokee – which seems to be a developer’s mistake. At the second step, the malware checks the input locale identifier using GetKeyboardLayout(). If it is Russian(ru-RU), Ukranian(uk-UA), Tatar(tt-RU), or Yakut(sah-RU), it does not encrypt the user’s files. ![Image 4: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/be4bdc502175c0988bf98aebda4ae877.png) ### Privilege escalation Once the language check is passed, Avaddon uses a well-known technique of bypassing UAC via a COM interface. The vulnerability is in executing elevated COM objects without UAC prompting to run processes with escalated privileges. The code of the exploit is available on github: https://gist.github.com/api0cradle/d4aaef39db0d845627d819b2b6b30512 Avaddon contains the registry keys to find CMSTPLUA and ICMLuaUtil class identifiers to exploit this vulnerability. Elevation:Administrator!new: CMSTPLUA {3E5FC7F9-9A51-4367-9063-A120244FBEC7} ICMLuaUtil {6EDD6D74-C007-4E75-B76A-E5740995E24C} The ransomware seems to borrow the exploit’s code from the public Github repository. ![Image 5: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/a56ea77bd508486a9524786644f8ee72.png) ![Image 6: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/0bf6bd31fbe93fa3568078e95a23c7d1.png) As a result of exploitation, the process ‘dllhost.exe’ responsible for running COM objects has been launched with elevated privileges. Moreover, it starts Avaddon’s code with admin rights. ![Image 7: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/4eca819a48c56238bb63c2622a47f7c0.png) Once executed, the ransomware deletes backups and shadow copies and disables automatic repair and recovery to prevent the restoration of original files on the infected system. wmic.exe SHADOWCOPY /nointeractive wbadmin DELETE SYSTEMSTATEBACKUP wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest bcdedit.exe /set {default} recoveryenabled No bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures vssadmin.exe Delete Shadows /All /Quiet Avaddon also cleans up the recycle bin. ![Image 8: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/85951e8b1683891ec750c1c4ce2289bc.png) ### Obfuscation All the versions of Avaddon ransomware contain obfuscated strings. The obfuscation algorithm hasn't been changed, except for its keys. Avaddon uses XOR and Base64 decoding to decrypt the encrypted strings. ![Image 9: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/06419c9fbdbe230e687b7ab53cb635ac.png) ### Encryption The encryption process has six steps: 1. Imports hardcoded master public RSA-2048 and master AES-CBC-256 keys. 2. Generates a session AES-CBC-256 key. 3. Adds IV to the master AES-CBC-256 key. 4. Uses the master AES-CBC-256 key to encrypt the data about the user with Base64 encoding and adds to the ransom note. 5. Encrypts the user’s files with the generated session AES-CBC-256 key. 6. Adds the session AES-CBC-256 key encrypted with RSA-2048 key to the end of every encrypted file. The public master RSA-2048 and AES-CBC-256 keys are hardcoded. ![Image 10: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/4746fd00fffed6b176ee3831441a3eea.png) ![Image 11: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/0499c732e97b4a8751db1b8fc2e1aba0.png) Avaddon ignores some important Windows folders during the encryption process: C:\Perflogs System volume information C:\Users\Public C:\Users\{User}\AppData\Local\Temp C:\Program Files (x86) C:\Users\{User}\AppData C:\ProgramData C:\Windows However, the ransomware is determined to encrypt Exchange and SQL servers, so it doesn’t skip the next paths: C:\Program Files\Microsoft\Exchange Server C:\Program Files (x86)\Microsoft\Exchange Server C:\Program Files\Microsoft SQL Server C:\Program Files (x86)\Microsoft SQL Server Avaddon also skips files with the following extensions: exe bin sys ini dll dat drv rdp prf swp lnk And terminates processes and services that could be related to VMware, malware analysis tools, and cybersecurity products: ![Image 12: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/c11fa48574e38c5a0699355b15badae1.png) After successful encryption, the folder looks like this: ![Image 13: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/9580e343d33a71132148b819f2b7c36b.png) ### Network connections Avaddon connects to api.myip.com to identify the victim’s IP address. ### Ransom note Once all the files have been encrypted, it sets up this wallpaper to notify the victim about the encryption, before putting the ransom note into every folder with encrypted files. ![Image 14: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/8a5f0f98e059555d0a6ef8b20b09856c.png) The wallpaper file is named ‘bcgmimg.bmp’ and can be found in the user’s folder. ![Image 15: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/897f4231e830fea3333332309f0055c4.png) The ransom note includes a unique extension randomly generated for each user, the Tor link to the decryption service, and the User ID which represents the collection of the encrypted data about the victim. ![Image 16: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/f27405049cf0fc33ab0fe50407df797c.png) ![Image 17: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/93dd8b33f8f787f764d74529f974dd73.png) The collected user’s information looks as follows. It is encrypted by the master AES-CBC-256 and Base64 encoded. ### Decryption service On the avaddonbotrxmuyl.onion page, the victim is asked to enter the User ID from the ransom note. ![Image 18: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/7ced9b864ba1d61098ede411b5ca9ced.png) After that, Avaddon notifies a victim about the decryption price, time left to pay with the starting price, and how to pay the ransom to BTC wallet: 3JiwAsg2g7TJy4A8rRVYoSy21ACv49831X. ![Image 19: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/acbfc4dd42bfbfaaf9299c37d2656099.png) ![Image 20: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/e263e158f2bbd3f9824cd36f676b17e1.png) ### Conclusion Avaddon follows the current ransomware trend by having its own data leak site. It changed its extension from .AVDN to the random sequence of characters. The encryption scheme has two hardcoded master keys (AES and RSA), which suggests that the creator of Avaddon is not experienced in ransomware development. The ransomware gets equipped with the privilege escalation technique and can be considered as a serious threat to target organizations. #### Detection by Acronis ![Image 21: Avaddon ransomware cleans the bin for you](https://staticfiles.acronis.com/images/content/2c2cf58eb9285e4942346bdf2f4a43bd.png) IoCs SHA256: E24F69AA8738D14B85AD76A1783D51120B8B6BA467190FE7D8F96AD2969C8FDF api.myip.com 104.31.66.68 Acronis Active Protection has successfully stopped the attack and restored the encrypted files. [Ransomware protection](https://www.acronis.com/en/blog/tags/ransomware-protection/) [MSP cybersecurity](https://www.acronis.com/en/blog/tags/msp-cybersecurity/) ## Written by ![Image 22: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png) Acronis Editorial Team Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), and enterprise IT departments. [Previous post](https://www.acronis.com/en/blog/posts/g2-review-server-backup-software/) [Acronis Cyber Backup a Clear “Leader” in the G2 Crowd Review Quadrant for Server Backup Software](https://www.acronis.com/en/blog/posts/g2-review-server-backup-software/) [Next post](https://www.acronis.com/en/blog/posts/how-msps-can-talk-clients-about-cybersecurity-awareness-month/) [How MSPs can talk to clients about Cybersecurity Awareness Month](https://www.acronis.com/en/blog/posts/how-msps-can-talk-clients-about-cybersecurity-awareness-month/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 23: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 24: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read ![Image 25: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png) [Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/) Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform. **October 05, 2026**4 min read