Behavioral task
behavioral1
Sample
7A5999C54F4588FF1581D03938B7DCBD874EE871254E2018B98EF911AE6C8DEE.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7A5999C54F4588FF1581D03938B7DCBD874EE871254E2018B98EF911AE6C8DEE.exe
Resource
win10v2004-20220812-en
General
-
Target
7A5999C54F4588FF1581D03938B7DCBD874EE871254E2018B98EF911AE6C8DEE
-
Size
872KB
-
MD5
81f01a9c29bae0cfa1ab015738adc5cc
-
SHA1
01785e1801e76063fb63deb78a208a3ca6e02cda
-
SHA256
7a5999c54f4588ff1581d03938b7dcbd874ee871254e2018b98ef911ae6c8dee
-
SHA512
41d3c2b03a9fd34206098eca99e25405a22b985dd3bc47326491647a8788a6463dc54a9fa80a4abb49f51c21a0809ca8eb0a46d60c1e32dbb0ef183938d15e3d
-
SSDEEP
12288:oTnK/17QNhQO/JGWYgeWYg955/155/vowaNxpLPGC2V+BOGDFofg06zP:MK/1QNhQO/Jg7vGCS+BOGDF+g0
Malware Config
Signatures
-
AtomSilo Ransomware 1 IoCs
resource yara_rule sample family_atomsilo -
Atomsilo family
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx
Files
-
7A5999C54F4588FF1581D03938B7DCBD874EE871254E2018B98EF911AE6C8DEE.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
lala Size: 536KB - Virtual size: 536KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
fafa Size: 328KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE