Behavioral task
behavioral1
Sample
d1a6ff8fbcb49b97107c3145ffbbeee44bd8886193856374002e4aaee27a50f3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d1a6ff8fbcb49b97107c3145ffbbeee44bd8886193856374002e4aaee27a50f3.exe
Resource
win10v2004-20240226-en
General
-
Target
d1a6ff8fbcb49b97107c3145ffbbeee44bd8886193856374002e4aaee27a50f3
-
Size
872KB
-
MD5
d015a2fae71978f785fa02c38423df2a
-
SHA1
1e0bb5360f52fbfce533788401070485364edbcb
-
SHA256
d1a6ff8fbcb49b97107c3145ffbbeee44bd8886193856374002e4aaee27a50f3
-
SHA512
622a886e52ba476dbf79cbca5c930dfc6c9dbbb6291b0274fcafd4becdbf5f03b51e3f5e5fdb689424f97a1838627f1b65907ccfeab5c6cc55992d7b52c2ca49
-
SSDEEP
12288:3L5Ya5t1QR5UXpNAG3vWYgeWYg955/155/rI2C7ECSz5+XJBLWe+nForgytP:75Ya5t1QRmXpNAG3AaDwKJWe+nFagy
Malware Config
Signatures
-
AtomSilo Ransomware 1 IoCs
resource yara_rule sample family_atomsilo -
Atomsilo family
-
Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
resource yara_rule sample patched_upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1a6ff8fbcb49b97107c3145ffbbeee44bd8886193856374002e4aaee27a50f3
Files
-
d1a6ff8fbcb49b97107c3145ffbbeee44bd8886193856374002e4aaee27a50f3.exe windows:5 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
lala Size: 536KB - Virtual size: 536KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
fafa Size: 328KB - Virtual size: 328KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE