Overview

overview

10

Static

static

10

ransomware...lo.hta

windows11-21h2-x64

1

ransomware...Me.hta

windows11-21h2-x64

3

ransomware...ox.hta

windows11-21h2-x64

1

ransomware...].html

windows11-21h2-x64

5

ransomware...de.hta

windows11-21h2-x64

3

ransomware...e2.hta

windows11-21h2-x64

3

ransomware...t.html

windows11-21h2-x64

5

ransomware...pt.hta

windows11-21h2-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ransomware_notes-main.zip

  • Size

    741KB

  • Sample

    240720-zgjjzaybrq

  • MD5

    2eb732ec669612f3ad61590427b719c0

  • SHA1

    d986fc145a3308852921efdb86e6b59bab76ff2b

  • SHA256

    fc9da0643ec0f4b03a8d10349e2c243c2daa65ae749b6a960edf34da59453cac

  • SHA512

    9e970ac8e572f5b7467c7ad05d39fdffe7bad750d6984dec53393665d4271cca6eae227c540dba5e39ca09cb9c90121e5d765ada4ac47fd449d803ba5f6afd38

  • SSDEEP

    12288:InvDL4m7By20SeXpwvh6cSfRLF+77+chT43A8aGo2BK3rf+W7ueFi:6f4m7Bl0Se6Sf5s7WA8aoMrfhSeFi

Score
10/10
atomsiloransomware

Malware Config

Extracted

Family

atomsilo

Ransom Note
Atom Slio Instructions WARNING! YOUR FILES ARE ENCRYPTED AND LEAKED! We are AtomSilo.Sorry to inform you that your files has been obtained and encrypted by us. But don’t worry, your files are safe, provided that you are willing to pay the ransom. Any forced shutdown or attempts to restore your files with the thrid-party software will be damage your files permanently! The only way to decrypt your files safely is to buy the special decryption software from us. The price of decryption software is 1000000 dollars . If you pay within 48 hours, you only need to pay 500000 dollars . No price reduction is accepted. We only accept Bitcoin payment,you can buy it from bitpay,coinbase,binance or others. You have five days to decide whether to pay or not. After a week, we will no longer provide decryption tools and publish your files Time starts at 0:00 on September 11 Survival time： You can contact us with the following email: Email:[email protected] If this email can't be contacted, you can find the latest email address on the following website: http://mhdehvkomeabau7gsetnsrhkfign4jgnx3wajth5yb5h6kvzbd72wlqd.onion If you don’t know how to open this dark web site, please follow the steps below to installation and use TorBrowser: run your Internet browser enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER wait for the site loading on the site you will be offered to download TorBrowser; download and run it, follow the installation instructions, wait until the installation is completed run TorBrowser connect with the button "Connect" (if you use the English version) a normal Internet browser window will be opened after the initialization type or copy the address in this browser address bar and press ENTER the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or use of TorBrowser, please, visit https://www.youtube.com and type request in the search bar "Install TorBrowser Windows" and you will find a lot of training videos about TorBrowser installation and use. Additional information: You will find the instructions ("README-FILE-#COMPUTER#-#TIME#.hta") for restoring your files in any folder with your encrypted files. The instructions "README-FILE-#COMPUTER#-#TIME#.hta" in the folders with your encrypted files are not viruses! The instructions "README-FILE-#COMPUTER#-#TIME#.hta" will help you to decrypt your files. Remember! The worst situation already happened and now the future of your files depends on your determination and speed of your actions.
Emails
URLs

http://mhdehvkomeabau7gsetnsrhkfign4jgnx3wajth5yb5h6kvzbd72wlqd.onion

Extracted

Ransom Note
YOUR WHOLE NETWORK HAS BEEN PENETRATED BY Black Hunt ! We also have uploaded your sensitive data, which we Will leak or sell in case of no cooperation! Restore your data possible only buying private key from us ATTENTION remember, there are many middle man services out there pretending that they can recover or decrypt your files , whom neither will contact us or scam you, Remember we are first and last solution for your files otherwise you will only waste money and time trying to decrypt your files without our decryptor and through third party softwares will make your files completely useless, there is no third party decryptor since we are the only key holders we have uploaded many critical data and information from your machines , we won't leak or sell any of them in Case of successful Corporation, however if we don't hear from you in 14 days we will either sell or leak your data in many forums Remain all of your files untouched, do not change their name, extension and... CONTACT US Your system is offline. in order to contact us you can email this address [email protected] this ID ( [snip] ) for the title of your email. If you weren't able to contact us whitin 24 hours please email: [email protected] , TELEGRAM : @tokyosupp Check your data situation in http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion
URLs

http://sdjf982lkjsdvcjlksaf2kjhlksvvnktyoiasuc92lf.onion

Extracted

Ransom Note
\r\n YOUR FILES ARE ENCRYPTED Your PC security is at risk All your files were encrypted and importantdatea was copied to our storage If you do not need your files, then the rivate {key will be deleted within 5 ays, If you wantdto restore files and eturn; importantdatea, ID of your personal operator If the Operator did not respond within 24hours) or encuntdered any rioblem then send an mainl to our support In the eader {of the letder, ndircte {your ID and attach 2-3 ndfected files for the decrypton dool Files sourld not have importantdnfo rmaion and sourld not exceed the ize:{of more than 5 MB As our guarantees, we will eturn; your files restored Atdenion ! Do not rename encrypted files. Do not ty too decrypt your atea using third prt.y software, nt may cause permanentdatea loss. Decrypton dof your files with the ealp{of third prt.ies may cause increased rivce (they add their fee to our) or you can becom pl victim{of a scam. ::: <

Extracted

Ransom Note
All Your Important Files Have Been Encrypted NOTE We have also taken your critical documents and files from different parts of your network, which we will leak or sell if there is no cooperation from your side. Our operators have been monitoring your business for a while, when we say these documents are critical, we mean it. We await for your response before the deadline ends, After that we will continue the process of leaking or selling your documents. We assure you that this won't happen if you cooperate with us. CONTACT US For more instructions, to save your files and your business, contact us by : Email address : [email protected] , TELEGRAM:@tokyosupp didn't get any response in 24 hours ? use : [email protected] Leave subject as your machine id " [snip] " If you didn't get any respond within 72 hours use our blog to contact us, therefore we can create another way for you to contact your cryptor as soon as possible. http://s2wk77h653qn54csf4gp52orhem4y72dgxsquxulf255pcymazeepbyd.onion/ ATTENTION Do not rename or change info of any file, in case of any changes in files after encryption there is a huge risk for making it unusable Do not pay any amount of money before receiving decrypted test files there might be many middle man services out there whom will contact us for your case and they will make a profit by adding a sort of money to the fixed price any attempts for decrypting your files through third party softwares will cause permanent damage to following files and permanent data loss there will be a deadline until your data get sold or leaked by our team,you better corporate with us before the following deadline otherwise we will proceed to sell or leak your data without any past warnings
URLs

http://s2wk77h653qn54csf4gp52orhem4y72dgxsquxulf255pcymazeepbyd.onion/

Extracted

Ransom Note
All Your Important Files Have Been Encrypted NOTE We have also taken your critical documents and files from different parts of your network, which we will leak or sell if there is no cooperation from your side. Our operators have been monitoring your business for a while, when we say these documents are critical, we mean it. We await for your response before the deadline ends, After that we will continue the process of leaking or selling your documents. We assure you that this won't happen if you cooperate with us. CONTACT US For more instructions, to save your files and your business, contact us by : Email address : [email protected] didn't get any response in 24 hours ? use : [email protected] Leave subject as your machine id " [snip] " If you didn't get any respond within 72 hours use our Tor blog to contact us, therefore we can create another way for you to contact your cryptor as soon as possible. http://o6pi3u67zyag73ligtsupin5rjkxpfrbofwoxnhimpgpfttxqu7lsuyd.onion ATTENTION Do not rename or change info of any file, in case of any changes in files after encryption there is a huge risk for making it unusable Do not pay any amount of money before receiving decrypted test files there might be many middle man services out there whom will contact us for your case and they will make a profit by adding a sort of money to the fixed price any attempts for decrypting your files through third party softwares will cause permanent damage to following files and permanent data loss there will be a deadline until your data get sold or leaked by our team,you better corporate with us before the following deadline otherwise we will proceed to sell or leak your data without any past warnings
URLs

http://o6pi3u67zyag73ligtsupin5rjkxpfrbofwoxnhimpgpfttxqu7lsuyd.onion

Targets

    • Target

      ransomware_notes-main/atomsilo/atomsilo.hta

    • Size

      7KB

    • MD5

      4351b336f2a6cafada3ce9a595bbd7ec

    • SHA1

      746a9ba5064b4112046b254184c932aa52c9a798

    • SHA256

      e1c251cecb10c495e378488bf3ed65a0666d575d3f2e2b03690466f10d072c9e

    • SHA512

      983d3e0580ebb16c4021cc0a08dfecd8410d629baba7c383079300e456b936ac6ead849ab1147985f9d3f52fb8fd2b0506319c2e66652eac2d1c9f0c9cae6752

    • SSDEEP

      192:lAhvMVjboHfg6fn4qA0VxXMsxXMgR5JDeYfB86pA2WY93pw9cn2dkw0:2jpS6pA9YR2dkb

    Score
    1/10
    behavioral1

    • Target

      ransomware_notes-main/blackhunt/#BlackHunt_ReadMe.html

    • Size

      12KB

    • MD5

      d512f8d61b24ae9308854a4217ed9068

    • SHA1

      37f08f01e0251c8b0dc2472ea6d425efd98d8166

    • SHA256

      39331e96cb53a91d3e4691375a665c9026f209a40aa3073a06c433a2504fc7a1

    • SHA512

      7b9059587d1de21101c57e2a199c1b43d2e23e6244d5c7fda2d116dacc4b227ed1d6a82c5726e78b8c6aa310bb217b0424cf2c3f40d5613ea325c5ba2d1650d9

    • SSDEEP

      192:6zNWVQDnFfSkURroocVPEnvQIl4EsD3nDk/hp9HE96EzIAaXCA/Mn3W9qz6OsQa7:SKAFfFU1QEnk3noZfE9L1aeLzNst4wV

    Score
    3/10
    behavioral2

    • Target

      ransomware_notes-main/crytox/crytox.hta

    • Size

      11KB

    • MD5

      cd94cf48071ec724d1a6deb8ef5cea21

    • SHA1

      72b7461463a9b4ff7c3d1adbfba33e5199aa84da

    • SHA256

      0a12f7f57765f3b8563c981df770ad4437a485ffb49066c641e8c94349e0eacd

    • SHA512

      18258171e01b5580a2653aa8b138e61a0266830e406262e464a2ee1a8419dca730a99bc6548d24c46cad49ce54f7189db62fd877525a79a6f2064a8e46c72e00

    • SSDEEP

      192:YmAXxU1UPRHPEXWcYvtwzXuFXqxmbLMfzfM8uaG3UN75B+OqdL8Afgr2pN:ZMREGszsvLMJdGEN75mZZgqpN

    Score
    1/10
    behavioral3

    • Target

      ransomware_notes-main/relic/UNLOCK_FILES.[hex_chars].HTML

    • Size

      4KB

    • MD5

      abf59c57469059e2872201077407692c

    • SHA1

      e1cc65fad127fc7d043a41f15820a986cae12514

    • SHA256

      66160952b84a6d3b1d8306d3030afc10394647ea6cbcef5ef7257cad7e4a5dba

    • SHA512

      9330ee9f3e21470263ca35f07c2090070976ee70f26bc52c4102051c839dd27a03f53f62c020c5f72a664b9387e32f20d21bdfd4ca9ebdaf65526c48a9dba94a

    • SSDEEP

      96:pyPghP1AL25f5yxKHkdsKm6656TiXW1LoElrMT:p5hP8GfYKHcpmDY2GpoUMT

    Score
    5/10

    • Drops file in System32 directory

    behavioral4

    • Target

      ransomware_notes-main/risen/Risen_Guide.hta

    • Size

      7KB

    • MD5

      ed8bb394d2cc6da81504c64f6637a129

    • SHA1

      f494c1fa59c792bf5ad12fbcc9b76e7ea295d24a

    • SHA256

      3d77996c43a97fc56b848f2338e545ae78f59dd204e5a9d71036c417c5c6e67f

    • SHA512

      312b5e1ab8c3c75654d3a4e5abdc395e0b065c03235c939c9aad0898f1e373165164bb61161fd14b6d98228c0b38a8348cd6274f463c4a8c4f3451f1b8856a41

    • SSDEEP

      192:Y1T0PEJgXTL6POrX7OEtSD/ERGowxxE5CCL:euL6Py1O/ERGfxE5FL

    Score
    3/10
    behavioral5

    • Target

      ransomware_notes-main/risen/Risen_Guide2.hta

    • Size

      7KB

    • MD5

      db63c985704626f70c2261112883aa25

    • SHA1

      ec044dff55fca1463fdae118d7370da9eb3f1830

    • SHA256

      acc560d69e004724c8c2cde54b8c69d32d63ba7a13528147d173e8b7c9d572dc

    • SHA512

      003d1f0731baee40c89e94687a34a7a82610b2786242b2250199ef214c1dcc1d808235baece6e5ce374b3c36bafc9b1c3984dce2d35e3d9a20fa1e0f734810f0

    • SSDEEP

      192:Y1T0PEJgXTL6POrX7OEtSD/ERG8xUxbE5CCL:euL6Py1O/ERGEUxbE5FL

    Score
    3/10
    behavioral6

    • Target

      ransomware_notes-main/suncrypt/suncrypt.html

    • Size

      10KB

    • MD5

      3a5dde15d6f0ca648b44810fbfc35736

    • SHA1

      6541c6d7f61e1b7fd809ee34ffdb86d6f3ee3a6c

    • SHA256

      0cb04884ca0fce43da755c3da08d943194dcfae11ed695de887ab03d45cb4e0c

    • SHA512

      6970431563c625af252e93f3263d12892428ca0ff236f19554ca6bc1752ad35d5ccaad857183c9aea7f32db6cf27d5ba9071220cdfc3f2336b267a0c3da019d2

    • SSDEEP

      192:Dnzcyc1zLuntm2petn2knAk/Hn5G/bYkczLGUxumD6bASsReVu01TJ:D+5wY3LGwDsvs00O

    Score
    5/10

    • Drops file in System32 directory

    behavioral7

    • Target

      ransomware_notes-main/trigona/how_to_decrypt.hta

    • Size

      8KB

    • MD5

      3cd198b4aa59896dbc82f3ccbc3160c3

    • SHA1

      94448891b6128bb1b14904b46c555d79a0debfc0

    • SHA256

      d582f49bfffaae2f244ffa0891ae82121b55b4b05283e7f8412840c8838f6f17

    • SHA512

      d11586b334f95194ccf5a0b6a7933c523655404d300c3c1f0adc5e79381f6d419550cb65ac5af79f3ec0c2d5d889e72d3c1c5be40a1efd24b13bcbd22d684cff

    • SSDEEP

      192:tobo6upscBzsN9VCq9iq1BtklKTbaB3VsLu:ao6upscBzyd3xu

    Score
    1/10
    behavioral8

MITRE ATT&CK Enterprise v15

Tasks