General
-
Target
ATOMSILO_2.exe
-
Size
328KB
-
Sample
211004-vc94xaggek
-
MD5
04a8307259478245cbae49940b6d655a
-
SHA1
0f5259812be378bbd764cef94697019075990b4d
-
SHA256
d9f7bb98ad01c4775ec71ec66f5546de131735e6dba8122474cc6eb62320e47b
-
SHA512
a2277ba16e1749ea7528f38640b2e2ca6d3aeb3c86df0bc417df37416fa6bc9be3bc84889e73793f8cda965676c2b0976bab140be2246dce7ab4ea6451d2e0f3
Static task
static1
Behavioral task
behavioral1
Sample
ATOMSILO_2.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
ATOMSILO_2.exe
Resource
win10v20210408
Malware Config
Extracted
C:\Users\Public\ATOMSILO-README.hta
atomsilo
Email:[email protected]
http://mhdehvkomeabau7gsetnsrhkfign4jgnx3wajth5yb5h6kvzbd72wlqd.onion
Targets
-
-
Target
ATOMSILO_2.exe
-
Size
328KB
-
MD5
04a8307259478245cbae49940b6d655a
-
SHA1
0f5259812be378bbd764cef94697019075990b4d
-
SHA256
d9f7bb98ad01c4775ec71ec66f5546de131735e6dba8122474cc6eb62320e47b
-
SHA512
a2277ba16e1749ea7528f38640b2e2ca6d3aeb3c86df0bc417df37416fa6bc9be3bc84889e73793f8cda965676c2b0976bab140be2246dce7ab4ea6451d2e0f3
Score10/10-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Deletes itself
-
Drops startup file
-