General

  • Target

    ATOMSILO_2.exe

  • Size

    328KB

  • Sample

    211004-vc94xaggek

  • MD5

    04a8307259478245cbae49940b6d655a

  • SHA1

    0f5259812be378bbd764cef94697019075990b4d

  • SHA256

    d9f7bb98ad01c4775ec71ec66f5546de131735e6dba8122474cc6eb62320e47b

  • SHA512

    a2277ba16e1749ea7528f38640b2e2ca6d3aeb3c86df0bc417df37416fa6bc9be3bc84889e73793f8cda965676c2b0976bab140be2246dce7ab4ea6451d2e0f3

Score
10/10

Malware Config

Extracted

Path

C:\Users\Public\ATOMSILO-README.hta

Family

atomsilo

Ransom Note
Atom Slio Instructions WARNING! YOUR FILES ARE ENCRYPTED AND LEAKED! We are AtomSilo.Sorry to inform you that your files has been obtained and encrypted by us. But don’t worry, your files are safe, provided that you are willing to pay the ransom. Any forced shutdown or attempts to restore your files with the thrid-party software will be damage your files permanently! The only way to decrypt your files safely is to buy the special decryption software from us. The price of decryption software is 1000000 dollars . If you pay within 48 hours, you only need to pay 500000 dollars . No price reduction is accepted. We only accept Bitcoin payment,you can buy it from bitpay,coinbase,binance or others. You have five days to decide whether to pay or not. After a week, we will no longer provide decryption tools and publish your files Time starts at 0:00 on September 11 Survival time: You can contact us with the following email: Email:[email protected] If this email can't be contacted, you can find the latest email address on the following website: http://mhdehvkomeabau7gsetnsrhkfign4jgnx3wajth5yb5h6kvzbd72wlqd.onion If you don’t know how to open this dark web site, please follow the steps below to installation and use TorBrowser: run your Internet browser enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER wait for the site loading on the site you will be offered to download TorBrowser; download and run it, follow the installation instructions, wait until the installation is completed run TorBrowser connect with the button "Connect" (if you use the English version) a normal Internet browser window will be opened after the initialization type or copy the address in this browser address bar and press ENTER the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or use of TorBrowser, please, visit https://www.youtube.com and type request in the search bar "Install TorBrowser Windows" and you will find a lot of training videos about TorBrowser installation and use. Additional information: You will find the instructions ("README-FILE-#COMPUTER#-#TIME#.hta") for restoring your files in any folder with your encrypted files. The instructions "README-FILE-#COMPUTER#-#TIME#.hta" in the folders with your encrypted files are not viruses! The instructions "README-FILE-#COMPUTER#-#TIME#.hta" will help you to decrypt your files. Remember! The worst situation already happened and now the future of your files depends on your determination and speed of your actions.
Emails
URLs

http://mhdehvkomeabau7gsetnsrhkfign4jgnx3wajth5yb5h6kvzbd72wlqd.onion

Targets

    • Target

      ATOMSILO_2.exe

    • Size

      328KB

    • MD5

      04a8307259478245cbae49940b6d655a

    • SHA1

      0f5259812be378bbd764cef94697019075990b4d

    • SHA256

      d9f7bb98ad01c4775ec71ec66f5546de131735e6dba8122474cc6eb62320e47b

    • SHA512

      a2277ba16e1749ea7528f38640b2e2ca6d3aeb3c86df0bc417df37416fa6bc9be3bc84889e73793f8cda965676c2b0976bab140be2246dce7ab4ea6451d2e0f3

    Score
    10/10
    • AtomSilo

      Ransomware family first seen in September 2021.

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Deletes itself

    • Drops startup file

MITRE ATT&CK Enterprise v6

Tasks