// Ransomware Negotiation Transcript
Avaddon Ransomware Negotiation — Redacted Organisation
// Context
About This Negotiation
This transcript documents a Avaddon ransomware negotiation with a redacted victim organisation. The negotiation consisted of 35 messages exchanged.
The initial ransom demand was $828.00. The final outcome is not confirmed in the transcript.
// Primary Source
Full Transcript — Verbatim
Reproduced from Casualtek's Ransomchats archive. URLs have been redacted.
Victim names are shown only where the breach was publicly reported in mainstream media. Any organisation wishing their name redacted can contact us at enquiries@binary-response.com — we will act promptly.
hello sir. how do i get my files back?
You need to pay the amount in BTC indicated on your page. The amount at the time of payment must be exactly the same as on the page!
After payment, we will provide you with a Decryptor that will decrypt all your files on all your PCs and servers.
You need to send 0.0276 BTC to Bitcoin address: [redacted]
Can i have discount on price? i only need one pc and about 50 files
We can not make a discount only for one computer.
The price is for all together. If it is too much for you, we can make a 5% discount
can you make it 1200 so i can pay within 1-2 days?
It is too small, we can make $ 1300.
ok i will try to find money. how do i pay?
You need to buy Bitcoin = 0.0277 BTC and then send it to the wallet [redacted]
price of bitcoin goes up and down. can we keep it 1300usd for when i do the payment in 1-2 days?
When will be ready to pay, ask and we will write you the exact amount in BTC.
ok?
ok bitcoin seller sais we need to keep price for 24hours stable so he can pay.
Ok, 0.0277 BTC
can we test your service somehow before we pay?
You can test decrypt only image file, not (.pdf .xlsx .txt ...). You have the ability to decrypt 1 image file up to 2 mb each.
can you please update the price to 1300$, so we can pay today?
0.0243 BTC
Bitcoin address: [redacted]
we found a bitcoin seller and he sais price for 1300$ is 0.02311 can we proceed with this? i have him on the phone now.
i gave him the money and he said he can send the 0.02311 now or i have to pay him more money. please accept so we can proceed with payment.
The amount will be higher because we added 5% to the amount for protection in case of a rate jump. This is necessary so that after payment, the system will automatically give you a decryptor. If the payment amount will be lower than that required, the system will not issue decryptor.
please sir, we don't know all this stuff. its just 5% decrease in price i request. we are out of money today and banks have closed here. We kindly ask you for this small favor to proceed today.
can you please update the price to deliver us the solution with this price: 0.02311 so we can move faster?
0.024 BTC is a minimum
please update price so i can beg the seller to give some small extra
You can just send 0.24 BTC
he will send 0.0241 to be sure ok ?
ok
payment done. transaction ID: [redacted]
0.0241 bitcoin
We see your transaction, now you need wait for 6 confirmations, it takes an average of 20-60 minutes. After 6 confirmations, you will receive a decryptor. On the payment page you will have a link to download the decryptor, run it on your PC according to the instructions when downloading.
You can download the decryptor on your payment page, update it. Run the decryptor according to the instructions.
// Analysis
Analyst Observations
- This transcript documents a Avaddon ransomware negotiation. The exchange provides insight into the group's negotiation tactics and communication style.