// Context
About This Negotiation
This transcript documents a Avaddon ransomware negotiation with a redacted victim organisation.
The negotiation consisted of 35 messages exchanged over Unknown.
The initial ransom demand was $828.00. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[Victim] — 07:54 12.05.2021 — Message 1/35
hello sir. how do i get my files back?
[Avaddon] — 07:58 12.05.2021 — Message 2/35
You need to pay the amount in BTC indicated on your page. The amount at the time of payment must be exactly the same as on the page!
[Avaddon] — 07:59 12.05.2021 — Message 3/35
After payment, we will provide you with a Decryptor that will decrypt all your files on all your PCs and servers.
[Avaddon] — 08:00 12.05.2021 — Message 4/35
You need to send 0.0276 BTC to Bitcoin address: [redacted]
[Victim] — 08:30 12.05.2021 — Message 5/35
Can i have discount on price? i only need one pc and about 50 files
[Avaddon] — 08:36 12.05.2021 — Message 6/35
We can not make a discount only for one computer.
[Avaddon] — 08:37 12.05.2021 — Message 7/35
The price is for all together. If it is too much for you, we can make a 5% discount
[Victim] — 08:43 12.05.2021 — Message 8/35
can you make it 1200 so i can pay within 1-2 days?
[Avaddon] — 08:48 12.05.2021 — Message 9/35
It is too small, we can make $ 1300.
[Victim] — 08:54 12.05.2021 — Message 10/35
ok i will try to find money. how do i pay?
[Avaddon] — 08:57 12.05.2021 — Message 11/35
You need to buy Bitcoin = 0.0277 BTC and then send it to the wallet [redacted]
[Victim] — 09:05 12.05.2021 — Message 12/35
price of bitcoin goes up and down. can we keep it 1300usd for when i do the payment in 1-2 days?
[Avaddon] — 09:18 12.05.2021 — Message 13/35
When will be ready to pay, ask and we will write you the exact amount in BTC.
[Avaddon] — 09:18 12.05.2021 — Message 14/35
ok?
[Victim] — 09:25 12.05.2021 — Message 15/35
ok bitcoin seller sais we need to keep price for 24hours stable so he can pay.
[Avaddon] — 09:28 12.05.2021 — Message 16/35
Ok, 0.0277 BTC
[Victim] — 10:51 12.05.2021 — Message 17/35
can we test your service somehow before we pay?
[Avaddon] — 10:55 12.05.2021 — Message 18/35
You can test decrypt only image file, not (.pdf .xlsx .txt ...). You have the ability to decrypt 1 image file up to 2 mb each.
[Victim] — 11:14 12.05.2021 — Message 19/35
can you please update the price to 1300$, so we can pay today?
[Avaddon] — 11:16 12.05.2021 — Message 20/35
0.0243 BTC
[Avaddon] — 11:16 12.05.2021 — Message 21/35
Bitcoin address: [redacted]
[Victim] — 11:17 12.05.2021 — Message 22/35
we found a bitcoin seller and he sais price for 1300$ is 0.02311 can we proceed with this? i have him on the phone now.
[Victim] — 11:20 12.05.2021 — Message 23/35
i gave him the money and he said he can send the 0.02311 now or i have to pay him more money. please accept so we can proceed with payment.
[Avaddon] — 11:20 12.05.2021 — Message 24/35
The amount will be higher because we added 5% to the amount for protection in case of a rate jump. This is necessary so that after payment, the system will automatically give you a decryptor. If the payment amount will be lower than that required, the system will not issue decryptor.
[Victim] — 11:22 12.05.2021 — Message 25/35
please sir, we don't know all this stuff. its just 5% decrease in price i request. we are out of money today and banks have closed here. We kindly ask you for this small favor to proceed today.
[Victim] — 11:23 12.05.2021 — Message 26/35
can you please update the price to deliver us the solution with this price: 0.02311 so we can move faster?
[Avaddon] — 11:25 12.05.2021 — Message 27/35
0.024 BTC is a minimum
[Victim] — 11:26 12.05.2021 — Message 28/35
please update price so i can beg the seller to give some small extra
[Avaddon] — 11:28 12.05.2021 — Message 29/35
You can just send 0.24 BTC
[Victim] — 11:30 12.05.2021 — Message 30/35
he will send 0.0241 to be sure ok ?
[Avaddon] — 11:32 12.05.2021 — Message 31/35
ok
[Victim] — 11:54 12.05.2021 — Message 32/35
payment done. transaction ID: [redacted]
[Victim] — 11:54 12.05.2021 — Message 33/35
0.0241 bitcoin
[Avaddon] — 11:55 12.05.2021 — Message 34/35
We see your transaction, now you need wait for 6 confirmations, it takes an average of 20-60 minutes. After 6 confirmations, you will receive a decryptor. On the payment page you will have a link to download the decryptor, run it on your PC according to the instructions when downloading.
[Avaddon] — 14:27 12.05.2021 — Message 35/35
You can download the decryptor on your payment page, update it. Run the decryptor according to the instructions.