// Context
About This Negotiation
This transcript documents a Avaddon ransomware negotiation with 20210518.
The negotiation consisted of 103 messages exchanged over Unknown.
The initial ransom demand was $80,000. The victim refused to pay.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at
enquiries@binary-response.com — we will act promptly.
[20210518] — 11:19 18.05.2021 — Message 1/103
hello can you help us recover our data/
[20210518] — 11:20 18.05.2021 — Message 2/103
can we call you to discuss how you can help us? we didn't see a telephone number or company name on the page.
[Avaddon] — 11:25 18.05.2021 — Message 3/103
Hello! You have been infected by the Avaddon ransomware. Price for you is $80,000. To receive a general decryptor, you need to pay the amount indicated to you in the BTC on the landing page. After paying the ransom, you will receive a general decryptor that will decrypt absolutely all PCs and servers on your network. We will also provide you with a list of vulnerabilities in your network so that a similar situation does not happen to you in the future. We also guarantee the anonymity of the and attack no one will recognize this incident. We are ready to talk to you and discuss on this matter.
[Avaddon] — 11:26 18.05.2021 — Message 4/103
We are here 24/7, for all your questions, write here and we will help you.
[20210518] — 11:37 18.05.2021 — Message 5/103
to be honest we will not need all your services, we just need 2 files to be restored from you. hopefully we have most data but there are some recent backups that cannot be restored to a recent point. So can you restore these with 5.000$? we are ready to cooperate with you to get recent data.
[Avaddon] — 12:48 18.05.2021 — Message 6/103
You must understand that the amount is indicated for everything together. We cannot provide you with a decryptor for only part of the files. The decryptor will decrypt all files.
[20210518] — 13:04 18.05.2021 — Message 7/103
so can you please give me a price that i can pay, so that i can purchase your service? mention that i live in greece and cannot find the money you said, not even close to it. So i want to work with you if you can help me recover my files. If you cannot i have to recreate about 30 days of entries in the database and it will take me probably 20 days to do so. I am now checking if you can help me skip the manual entries.
[Avaddon] — 13:08 18.05.2021 — Message 8/103
We understand your situation and are ready to offer you a 15% discount on the total amount.
[20210518] — 13:35 18.05.2021 — Message 9/103
unfortunately cannot pay for your service. Can you find a solution i can pay so we can work together? The amounts you ask is for US corporation. I own office in greece and i just need part of your service. i have my data, but need to skip manual work for now. Do you believe you can give me a price i can pay?
[Avaddon] — 14:10 18.05.2021 — Message 10/103
How much can you offer us, but please note that we cannot agree on $ 5,000.
[20210518] — 15:04 18.05.2021 — Message 11/103
6000 $ ? How fast we can have the data back? we have already started the manual entries of invoices so until tomorrow i will have clear picture of what we have. also we are moving all our restored data to microsoft 365, eveyrhting seems to be ok apart from our 2 databases with missing data. I will know tomorrow how much work we need of manual entries.
[Avaddon] — 15:11 18.05.2021 — Message 12/103
$ 6,000 is still not enough. We cannot work with this amount. You need to offer more.
[20210518] — 15:20 18.05.2021 — Message 13/103
as i understand we cannot work together. So we will see what we can recover with manual work in the following days. Your service would help me a lot save time if it is fast but you are very expensive for me.
[Avaddon] — 15:25 18.05.2021 — Message 14/103
After payment we will give you our Avaddon Decryptor, which will decrypt all your files on all your PCs and servers in a few hours. You can get back to work very quickly.
[20210518] — 15:52 18.05.2021 — Message 15/103
that is vey good news. but we cannot meet your price needs.
[Avaddon] — 15:56 18.05.2021 — Message 16/103
We want to help you and have made a big discount, but we cannot accept such a small amount.
[Avaddon] — 15:57 18.05.2021 — Message 17/103
You need to offer more so that we can work.
[20210518] — 18:30 18.05.2021 — Message 18/103
what about 8.5k ?
[Avaddon] — 20:01 18.05.2021 — Message 19/103
you give us amounts that we are not interested in at all, if you want to get a decryptor you need to offer a much higher amount
[20210518] — 20:31 18.05.2021 — Message 20/103
please give us a price we can pay so we can decide if we can move further. Mention that we are not US, our office is in greece and we just opened after 3 lockdowns. If you cannot give us an amount we can pay we will just move forward. I really don't want to waste your time.
[Avaddon] — 20:43 18.05.2021 — Message 21/103
we understand the current situation and are ready to make concessions to you and charge a new price of $ 60,000
[20210518] — 21:03 18.05.2021 — Message 22/103
the price range you give is unfortunately out of reach, i guess we will proceed without your service. thank you for your support.
[Avaddon] — 21:11 18.05.2021 — Message 23/103
what is the maximum amount you are willing to offer us?
[Avaddon] — 05:20 19.05.2021 — Message 24/103
Guys ?
[20210518] — 08:06 19.05.2021 — Message 25/103
Ok we are ready to pay 55k$ is it ok with you?
[20210518] — 08:12 19.05.2021 — Message 26/103
Are you there?
[Avaddon] — 08:17 19.05.2021 — Message 27/103
Ok
[Avaddon] — 08:18 19.05.2021 — Message 28/103
You need to send 1.44 BTC to Bitcoin address: [redacted]
[20210518] — 09:22 19.05.2021 — Message 29/103
I am unable to pay you ? is your bitcoin address correct?
[Avaddon] — 09:24 19.05.2021 — Message 30/103
[redacted]
[Avaddon] — 09:24 19.05.2021 — Message 31/103
This address is correct.
[20210518] — 10:01 19.05.2021 — Message 32/103
It's segwit address and due to that I believe I am getting the error
[Avaddon] — 10:04 19.05.2021 — Message 33/103
Have you already figured out the problem? Because the address is correct, the problem is on your part.
[20210518] — 10:13 19.05.2021 — Message 34/103
Still facing issue
[Avaddon] — 10:44 19.05.2021 — Message 35/103
If you yourself cannot buy, then seek help from a specialist. Because everything works from our side.
[20210518] — 13:15 19.05.2021 — Message 36/103
hi there, i want to know if you can give us a price we can pay so we can pay you. If we delay a lot discussing and chatting there is no interest from our side to buy your service. We already have setup most things in Microsoft. Our emails are ok, oru files were recovered from offline backups but we are missing 2 databases. These contain important data but we have hardcopies of invoices. Our accountants started inputting theses invoices in the old database. We have two ways here. We can work manually and in a few weeks people will put all the invoices to our offline backups and this is 100% certain. It costs man hours but will work 100%. On the other hand we have you through a chat asking insane amounts of money and we are not certain 100% that you will help us since you don't give us your company name. We told you that we will not allocate a lot of money to that. One way is certain with delay but your way is uncertain and you are asking unrealistic amounts.
[Avaddon] — 13:37 19.05.2021 — Message 37/103
Guys, what nonsense are you starting to say, you just tried to put $ 55k into our account and work with us, and now you start telling us tales that this is a lot of money, a lot of money is millions of dollars, and you work with us for only 55k despite the fact that we gave you a huge discount !? Did you lie to us that you tried to send money? We are a serious organization we are "Avaddon Ransomware". If you have doubts about data decryption, then on your landing page there is a "Test Decryption" section, upload an image file weighing up to 2MB and after a while you will receive a decrypted file.
[Avaddon] — 13:40 19.05.2021 — Message 38/103
Guys, do you want us to give you the motivation to pay us?
[Avaddon] — 13:40 19.05.2021 — Message 39/103
:D
[Avaddon] — 13:42 19.05.2021 — Message 40/103
Take it. We've stolen over 25GB of data from your network. What if I tell you the exact number of files? These are 50382 files!
[Avaddon] — 13:47 19.05.2021 — Message 41/103
If payment is not made within 24 hours, we will publish a post about the leakage of your data, make mass spam by emails of your competitors, clients, partners and tell them that all confidential data that they had associated with you was leaked through your fault. Believe me, we know how much money will be spent on investigations and lawsuits. It will be much more than 55k.
[Avaddon] — 13:48 19.05.2021 — Message 42/103
Do you need confirmation that we have the data? This is not a problem, we will provide them to you. Just tell us to do it.
[Avaddon] — 13:49 19.05.2021 — Message 43/103
I hope you pay and I don’t have to tell you what else we will do with your network in case of non-payment...
[Avaddon] — 13:51 19.05.2021 — Message 44/103
Cooperating with us, we guarantee you complete confidentiality on our part, General decryptor with which you can restore absolutely all files on your PCs / Servers, a complete tree of the files we have taken from you and confirmation of their deletion after payment. We will also point out to you the vulnerabilities in your network and give recommendations on what to do to eliminate these vulnerabilities, following our security recommendations, you will be practically invisible to hacker attacks.
[Avaddon] — 13:57 19.05.2021 — Message 45/103
I think the choice is obvious. I changed the time for you to 24 hours, the time has gone. Tick tock tick tock
[20210518] — 14:07 19.05.2021 — Message 46/103
Sir we are not interested in your whole services. We cannot pay for it. Can you recover for us 2 files? Also we never told you that we can pay so high. We were willing to buy your service for 8.5k. Please lets find a way to work in this range so it has some value to us. The amount you ask is unfortunately out of reach by far.
[Avaddon] — 14:15 19.05.2021 — Message 47/103
these are your words "Ok we are ready to pay 55k$ is it ok with you? "
[20210518] — 14:32 19.05.2021 — Message 48/103
no sir. I didn't say that. we cannot find that money, not even close. Although we could give you money for your service, because it will help us save time. this is 5 times more than we can afford. don't forget i told you that our office is in greece. not in the united states of america or germany. So we cannot afford your services. So if you don't help us pay, we cannot pay.
[Avaddon] — 14:45 19.05.2021 — Message 49/103
In the Meaning, you didn't say that? Check out our communication history above, you wrote it.
[20210518] — 15:06 19.05.2021 — Message 50/103
sir we cannot pay 55k. 5k yes we can pay instantly for your work.
[Avaddon] — 16:03 19.05.2021 — Message 51/103
We are not interested in this price.
[20210518] — 17:39 19.05.2021 — Message 52/103
ok
[20210518] — 21:35 19.05.2021 — Message 53/103
do you believe that 11000$ will work for you? i just want to see if we can help each other come to an amount that 1) can be paid 2) can be found quickly by our side, because we could be able to find some money more but we need extra time, probably a 1-2 weeks to apply for some loan. But if we delay there is no meaning for us. just let me know because we need to decide during the weekend cause i need to inform our boss to take a decision.
[Avaddon] — 21:47 19.05.2021 — Message 54/103
11,000 $ are not enough.
[Avaddon] — 21:48 19.05.2021 — Message 55/103
You need to offer more if you do not want us to publish your files.
[20210518] — 22:50 19.05.2021 — Message 56/103
the only thing we want from your service is to have our recent files back. if we agree on that and to the amount we can pay in 3-4 days because we need some days to gather 11.000$
[20210518] — 22:57 19.05.2021 — Message 57/103
its late here. i need to go to sleep. please decide soon if you accept so we can start finding the money. every day of manual work costs about 250$, we estimated that we need about 2 months to finish manual work with invoices and update our lost data. so if you give us good price, our boss will decide to pay you for faster results.
[Avaddon] — 23:13 19.05.2021 — Message 58/103
Guys, you do not understand, you have a lot of problems. To restore the normal mode of operation, you need a lot of time and money. If you do not pay, then you are waiting for news in our blog, we will publish a lot of your files that you will not like. You will get damage to much more than $ 55,000. We offer you a solution to all these issues for an adequate price.
[Avaddon] — 23:15 19.05.2021 — Message 59/103
We have already made a big discount for you and are ready to work with you, but we are not satisfied with $ 11,000.
[Avaddon] — 01:25 20.05.2021 — Message 60/103
We are ready to make a small discount for you.
[20210518] — 06:08 20.05.2021 — Message 61/103
you constantly say other things. not interested. we just need 2 files and an amount we can pay. small discount cannot be paid. big discount from your side will be paid. just need those files faster. why you always say not satisfied? right now we can pay you 8000$, we can find another 3000-8000$ by next week. but we cannot make money appear out of nothing. clients need to pay us for us to find the money. if you cannot work with this unfortunately we cannot afford your service. please help us pay you.
[Avaddon] — 07:05 20.05.2021 — Message 62/103
Perhaps we can go down a little lower, but the price you offer absolutely does not suit us, we have already made you a big discount, if you do not go up then there will be no deal.
[20210518] — 09:11 20.05.2021 — Message 63/103
can we pay in installments like 5000$ for 3 weeks? please help us purchase the service. we cannot pay with money we don't have. i am trying to figure out a way to work with you, but your demands still are 3 times more than we can afford to pay.
[Avaddon] — 09:17 20.05.2021 — Message 64/103
take a loan or find money in some other way, if your files are important to you, then you will find money.
[20210518] — 11:10 20.05.2021 — Message 65/103
our boss visited the bank this morning, loan will take about a week to reply to us. They cannot tell us yet if they can loan to us money. I will keep you updated. But we will need time. In the meantime let me know if we can find a way with less money so we can purchase part of your services.
[Avaddon] — 11:12 20.05.2021 — Message 66/103
You cannot pay for only 1 decrypted file, you either buy the General Decryptor which will decrypt absolutely all your files or there will be no deal.
[Avaddon] — 11:12 20.05.2021 — Message 67/103
We will give you additional time to search for money, and we will not publish a publication about your data leak while you are looking for money.
[20210518] — 11:18 20.05.2021 — Message 68/103
i would like to know if we can reach an amount of 20k in 2 weeks so i can see if we can reach something like this after some time. Because everyday we pay people to input old invoices. So if we find an amount we can meet your demands or there is no chance we can reach each other demands and convenience.
[Avaddon] — 11:32 20.05.2021 — Message 69/103
Guys, look, we will give you the last price, $ 30k, this price is no longer discussed, either you pay exactly 30k or there will be no deal and we can say goodbye to you.
[20210518] — 12:30 20.05.2021 — Message 70/103
allow us 1 week to see if we can find the funds and when.
[Avaddon] — 13:28 20.05.2021 — Message 71/103
Ok
[Avaddon] — 13:29 20.05.2021 — Message 72/103
done
[20210518] — 07:19 21.05.2021 — Message 73/103
hi
[20210518] — 07:21 21.05.2021 — Message 74/103
hello
[Avaddon] — 07:30 21.05.2021 — Message 75/103
Hello, how can i help you?
[20210518] — 07:51 21.05.2021 — Message 76/103
we have found an employee that has monero. we will buy from him today and we can pay him in installments so we will pay today to save time.
[20210518] — 07:54 21.05.2021 — Message 77/103
please promise that when we pay you you will recover all our files and you will stop any bad actions to our network. Also you will tell us how we will secure our network in the future.
[Avaddon] — 07:56 21.05.2021 — Message 78/103
After you make a payment, we guarantee the anonymity of the attack. We will not disseminate information about hacking your network, no one will know that your company was attacked. We will provide global decryption that will decipher all your files throughout your network. We also delete all your data and send you evidence of deletion. In addition, we guarantee you immunity from attacks on your company in the future.
[Avaddon] — 08:48 21.05.2021 — Message 79/103
When will you pay?
[20210518] — 09:45 21.05.2021 — Message 80/103
probably today.
[20210518] — 09:45 21.05.2021 — Message 81/103
probably today
[20210518] — 09:47 21.05.2021 — Message 82/103
We tried to decrypt this file in test decryption: [redacted].jpg.[redacted].[redacted] but it rejects it
[20210518] — 09:48 21.05.2021 — Message 83/103
i tried to decrypt this file in test: [redacted].jpg.[redacted].[redacted]. It doesn't decrypt it.
[20210518] — 09:48 21.05.2021 — Message 84/103
i tried to decrypt this file in test: [redacted].jpg.[redacted].[redacted]. It doesn't decrypt it.
[20210518] — 09:50 21.05.2021 — Message 85/103
your chat has problems today. i submit my chat 10 times before it accepts it.
[Avaddon] — 10:12 21.05.2021 — Message 86/103
Try another image with extension .jpg
[Avaddon] — 20:06 21.05.2021 — Message 87/103
ok sir ?
[20210518] — 20:12 21.05.2021 — Message 88/103
why try another image? What will happen to these files that have double extention? Will they be decrypted?
[20210518] — 20:15 21.05.2021 — Message 89/103
my most important files have 2 additional extensions and they are not accepted by test decryption. I am starting to worry about your service to be honest
[Avaddon] — 20:27 21.05.2021 — Message 90/103
This extension is not decrypt in test decryption. In test decryption, how can you see only files with certain extensions can be decrypted. Do not worry, General Decryptor will decrypt absolutely all files on your PCs and servers.
[20210518] — 20:43 21.05.2021 — Message 91/103
so you guarantee that all files, even files with double extention will be decrypted right?
[Avaddon] — 20:55 21.05.2021 — Message 92/103
Of course, Sir absolutely all files will be decrypted, there will be no problems with it, we promise you.
[20210518] — 21:02 21.05.2021 — Message 93/103
check the test decryption. i uploaded a file and it doesn't work. it doesn't open.
[Avaddon] — 21:06 21.05.2021 — Message 94/103
Wait a bit
[Avaddon] — 21:29 21.05.2021 — Message 95/103
u can download your file [redacted].png
[20210518] — 22:58 21.05.2021 — Message 96/103
file cannot open/ try to open it and send me screenshot.
[Avaddon] — 23:15 21.05.2021 — Message 97/103
Send us 1 image file and we will decrypt. Use [REDACTED URL]
[20210518] — 23:39 21.05.2021 — Message 98/103
ok. this is the file: [REDACTED URL]
[Avaddon] — 23:49 21.05.2021 — Message 99/103
Ok, we'll decrypt and send it to you.
[Avaddon] — 07:06 22.05.2021 — Message 100/103
Archive: [REDACTED URL] Password: [redacted]
[Avaddon] — 07:09 22.05.2021 — Message 101/103
Here is the decrypted file
[Avaddon] — 11:30 22.05.2021 — Message 102/103
We received $ 100 from you. You can send the rest.
[Avaddon] — 20:42 22.05.2021 — Message 103/103
You can download the decryptor on your payment page, update it. Run the decryptor according to the instructions.