ab.bin

Classification: Malicious

ab.bin is a ransomware (application/x-dosexec, 775.5 KB). Detected by 94 antivirus engines. Linked to Avaddon malware. 8 sightings, last seen 2026-07-26.

Detection summary

  • 94 antivirus detections
  • 0 IDS alerts
  • 10 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: AVADDON (S0640)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Avaddon Triage 2026-02-07 06:26:33 2026-07-26 21:47:01 malicious-activity S0640 Avaddon
Generic Malware Hybrid-Analysis 2024-02-26 15:45:03 2024-02-26 16:15:05
Ransomware VM-Ray 2023-03-11 06:20:43 2023-03-11 06:20:43
Avaddon MalwareBazaar Abuse.ch 2023-03-11 04:18:31 2023-03-11 04:18:31 S0640 Avaddon
Avaddon ThreatFox Abuse.ch 2021-11-25 19:45:30 2021-11-27 00:07:15 S0640 Avaddon

Tags

win.avaddon evasive avaddon defense_evasion discovery execution impact ransomware trojan

Sample information

Filenames
ab.bin, 1228d0f04f0ba82569fc1c0609f9fd6c377a91b9ea44c1e7f9f84b2b90552da2.exe, 1228d0f04f0ba82569fc1c0609f9fd6c377a91b9ea44c1e7f9f84b2b90552da2
File type
application/x-dosexec
Size
794112 bytes
MD5
0b486fe0503524cfe4726a4022fa6a68
SHA-1
297dea71d489768ce45d23b0f8a45424b469ab00
SHA-256
1228d0f04f0ba82569fc1c0609f9fd6c377a91b9ea44c1e7f9f84b2b90552da2
SHA-512
f4273ca5cc3a9360af67f4b4ee0bf067cf218c5dc8caeafbfa1b809715effe742f2e1f54e4fe9ec8d4b8e3ae697d57f91c2b49bdf203648508d75d4a76f53619
First indexed
2021-11-26 00:06:12
Last updated
2026-09-03 04:09:31

Antivirus detections

EngineDetection
LionicTrojan.Win32.Generic.j!c
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
CAT-QuickHealTrojan.AvaddPMF.S20724522
ALYacTrojan.Ransom.Avaddon
CylanceUnsafe
ZillyaTrojan.Filecoder.Win32.18512
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 00577dec1 )
AlibabaRansom:Win32/Avaddon.d977d1d4
K7GWTrojan ( 00577dec1 )
Cybereasonmalicious.050352
CyrenW32/Ransom.OS.gen!Eldorado
SymantecRansom.Avaddon!g1
ESET-NOD32a variant of Win32/Filecoder.Avaddon.C
APEXMalicious
Paloaltogeneric.ml
ClamAVWin.Ransomware.Avaddon-9852658-0
KasperskyHEUR:Trojan-Ransom.Win32.Generic
BitDefenderGen:Variant.Ransom.Avaddon.3
NANO-AntivirusTrojan.Win32.Filecoder.ivvxhh
MicroWorld-eScanGen:Variant.Ransom.Avaddon.3
AvastWin32:Trojan-gen
TencentMalware.Win32.Gencirc.10ce4b59
Ad-AwareGen:Variant.Ransom.Avaddon.3
SophosTroj/Avaddon-A
DrWebTrojan.MulDrop16.12853
VIPRETrojan.Win32.Generic!BT
TrendMicroRansom.Win32.AVADDON.SMTHA
McAfee-GW-EditionTrojan-FTMI!0B486FE05035
FireEyeGeneric.mg.0b486fe0503524cf
EmsisoftGen:Variant.Ransom.Avaddon.3 (B)
IkarusTrojan-Ransom.Avaddon
GDataGen:Variant.Ransom.Avaddon.3
JiangminTrojan.DelShad.bhg
WebrootW32.Trojan.Gen
AviraHEUR/AGEN.1136765
Antiy-AVLTrojan/Generic.ASMalwS.3198A1A
GridinsoftMalware.Win32.Gen.bot!se54774
ArcabitTrojan.Ransom.Avaddon.3
MicrosoftRansom:Win32/Avaddon.MK!MTB
TACHYONRansom/W32.Avaddon.794112
AhnLab-V3Malware/Win.Ransom.R421765
McAfeeTrojan-FTMI!0B486FE05035
MAXmalware (ai score=100)
VBA32Trojan.MulDrop
MalwarebytesRansom.Avaddon
TrendMicro-HouseCallRansom.Win32.AVADDON.SMTHA
RisingRansom.Avaddon!1.C7A8 (CLASSIC)
YandexTrojan.DelShad!9+W8qxhoK3A
SentinelOneStatic AI - Malicious PE
eGambitUnsafe.AI_Score_100%
FortinetW32/Avaddon.C!tr.ransom
BitDefenderThetaGen:NN.ZexaF.34294.Wu0@a8mRu3ni
AVGWin32:Trojan-gen
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (W)
MaxSecureTrojan.Malware.74279478.susgen
AVGWin32:MalwareX-gen [Ransom]
AlibabaRansom:Win32/Avaddon.4ec8f9e5
Antiy-AVLTrojan[Ransom]/Win32.Avaddon
ArcabitTrojan.Trojan.Ransomware.D43A
AvastWin32:MalwareX-gen [Ransom]
AviraTR/W32.MalwareX
BitDefenderGen:Variant.Trojan.Ransomware.1082
BkavW32.Malware.6AD508BF
CAT-QuickHealRansom.Avvadon.S25780554
CTXexe.trojan.avaddon
CynetMalicious (score: 99)
DeepInstinctMALICIOUS
ESET-NOD32Win32/Filecoder.Avaddon.C trojan
EmsisoftGen:Variant.Trojan.Ransomware.1082 (B)
F-SecureTrojan.TR/W32.MalwareX
GDataGen:Variant.Trojan.Ransomware.1082
GoogleDetected
LionicTrojan.Win32.Avaddon.j!c
MalwarebytesMalware.AI.4249054699
McAfeeDti!1228D0F04F0B
MicroWorld-eScanGen:Variant.Trojan.Ransomware.1082
PandaTrj/Genetic.gen
SentinelOneStatic AI - Suspicious PE
SkyhighBehavesLike.Win32.Dropper.bh
SymantecML.Attribute.HighConfidence
TencentMalware.Win32.Gencirc.10bd4da4
Trapminesuspicious.low.ml.score
TrellixENSTrojan-FTMI!0B486FE05035
VIPREGen:Variant.Trojan.Ransomware.1082
VaristW32/Ransom.OS.gen!Eldorado
VirITTrojan.Win32.Genus.LZM
WebrootW32.Ransom.Avaddon
XcitiumMalware@#34yb2tmqqealb
ZoneAlarmTroj/Avaddon-A
alibabacloudRansomWare:Win/Avaddon
huorongRansom/LockFile.i

Process list

NameCommand line
ab.bin.exe
wmic.exewmic SHADOWCOPY DELETE /nointeractive
wmic.exewmic SHADOWCOPY DELETE /nointeractive
wmic.exewmic SHADOWCOPY DELETE /nointeractive
wmic.exewmic SHADOWCOPY DELETE /nointeractive
wmic.exewmic SHADOWCOPY DELETE /nointeractive
wmic.exewmic SHADOWCOPY DELETE /nointeractive
WerFault.exe-pss -s 440 -p 5732 -ip 5732
WerFault.exe-u -p 5732 -s 964
ab.bin.exe