Overview

overview

10

Static

static

3

5f614a8e35...e4.exe

windows10-2004-x64

10

5f614a8e35...e4.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe
  • Size 6.0MB
  • Sample260206-nnn79aav7c
  • SHA256 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
atomsilocredential_accessdiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\PerfLogs\README-FILE-WAYEYPDI-1770377578.hta

Ransom Note
  • <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Atom Slio: Instructions</title> <HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style type="text/css"> .text{ text-align:center; } a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #f3f3fc; border: 2pt solid #bda; display: inline-block; padding: 1%; text-align: center; box-sizing:border-box; border-radius:20px; } .h { display: none; } .ml1{ position:absolute;width:50%;height:10rem;left:-211px;top:0;background:#f3f3fc;border:1px solid #cfd3da;box-sizing:border-box;padding:2% 2% } </style> </head> <body> <div class="container"> <div class="header"> <h1>Atom Slio</h1> <small id="title">Instructions</small> </div> <div class="text"> <span style="color:#f71b3a;font-size:40px">WARNING! YOUR FILES ARE ENCRYPTED AND LEAKED!</span> </div> <hr> <div class="info"> <p>We are AtomSilo.Sorry to inform you that your files has been obtained and encrypted by us.</p> <p>But don’t worry, your files are safe, provided that you are willing to pay the ransom.</p> <p>Any forced shutdown or attempts to restore your files with the thrid-party software will be <span style="color:#f71b3a">damage your files permanently!</span></p> <p>The only way to decrypt your files safely is to buy the special decryption software from us. </p> <p>The price of decryption software is <span style="color:#f71b3a">500000 dollars</span>. <br>If you pay within 48 hours, you only need to pay <span style="color:#f71b3a">70% off dollars</span>. No price reduction is accepted.</p> <p>We only accept Bitcoin payment,you can buy it from bitpay,coinbase,binance or others. </p> <p>You have five days to decide whether to pay or not. After a week, we will no longer provide decryption tools and publish your files</p> </div> <hr></hr> <div align="center"> <span style="color:#f71b3a;font-size:200%">Time starts at 0:00 on December 10 </span> <hr></hr> <span style="color:#f71b3a;font-size:300%"> <a>Survival time：</a> <span id="td"></span> <span id="th"></span> <span id="tm"></span> <span id="ts"></span> </span> </div> <script type="text/javascript"> function getRTime(){ var EndTime= new Date('2021/12/12 00:00:00'); var NowTime = new Date(); var t =EndTime.getTime() - NowTime.getTime(); var d=Math.floor(t/1000/60/60/24); var h=Math.floor(t/1000/60/60%24); var m=Math.floor(t/1000/60%60); var s=Math.floor(t/1000%60); document.getElementById("td").innerHTML = d + " Day "; document.getElementById("th").innerHTML = h + " Hour "; document.getElementById("tm").innerHTML = m + " Min "; document.getElementById("ts").innerHTML = s + " Sec "; } setInterval(getRTime,1000); </script> <hr></hr> <p>You can contact us with the following email: <p><a href="mailto:[email protected]"><span class="info">Email:[email protected] </span></a></p> <p>If this email can't be contacted, you can find the latest email address on the following website:</p> <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p> <hr> <p>If you don’t know how to open this dark web site, please follow the steps below to installation and use TorBrowser:</p> <ol> <li>run your Internet browser</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER</li> <li>wait for the site loading</li> <li>on the site you will be offered to download TorBrowser; download and run it, follow the installation instructions, wait until the installation is completed</li> <li>run TorBrowser</li> <li>connect with the button "Connect" (if you use the English version)</li> <li>a normal Internet browser window will be opened after the initialization</li> <li>type or copy the address in this browser address bar and press ENTER</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> <p>If you have any problems during installation or use of TorBrowser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the search bar "Install TorBrowser Windows" and you will find a lot of training videos about TorBrowser installation and use.</p> <hr> <p><strong>Additional information:</strong></p> <p>You will find the instructions ("README-FILE-#COMPUTER#-#TIME#.hta") for restoring your files in any folder with your encrypted files.</p> <p>The instructions "README-FILE-#COMPUTER#-#TIME#.hta" in the folders with your encrypted files are not viruses! The instructions "README-FILE-#COMPUTER#-#TIME#.hta" will help you to decrypt your files.</p> <p>Remember! The worst situation already happened and now the future of your files depends on your determination and speed of your actions.</p> </div> <span class="h">AESKEY</span> </body> </html><asf>nkObyGy47pIc8ZBFn0B8ZuCvF7+h+hdrivVbxFKvntTTYKWRGPGDm83t3oUGT6LqR+UDWEBi92IOnXK3MyvlkNy/fridy7IxtPNHJk/T3l9tjseruCoJvblwlHVHK8zSIJKbDqGJKQ6PGrcaKELaChLNfZi/8Ea9Zi0/5IJE4tq7hNpjs7710o9SEEESv0t2QP6suk6zV6wUJdIxMTNvFb3IfOMinZm8ClbYkIjQFZPsgMvOCX0LW046swJUpNFoi4YRP500uXKRKnSWT0TtTdVscuGNov2PHxchnLjkCuZSn2kqAogc8pLXiHIphy5YNQd2oXAHVs7iEwp8vhnTojDrt3BnyiWxFWStjvEXt2KEszlvx6Gi4gQMwaKkGP9InkbD02Z9KG3i63edxC8T483XUKkQAs0orcWRFkheP1QaknPyjtQF3UJnpqxq7RDgMHStds0RWSiVubZagCyHZ5L0CJk+v3/SjPWBxfecGI+7oh4ZkgbKnDU91Q0JC87Mu/F6823ag+p3+YjuK/jCuhqDcbafUjwsNeBznJQAa/mqeRRCWhZ8lQFTtpYVH9oUmtEkp/MBsrDxW5VXx/1aPLqbetw0wEVVU3oSfFlMBpwbXyuVM/mjZfCAK6XftYyQq0dJmyHPkwzwkPN5ZDGt57GvP1fFOBnStSjyaRhteia6cxtv41Q+qrAVPr0C1tPXL79GGaMbaMQAhe4+vQbz6KTaEF4GBbdFf2nVvXpiF7V4lGrUgYcg8qERBaGV2v0Nhnj6z1SdCcon5bwnYxDO91mrMH6IShDRGV4aWdJA2tvpS72H+DzSV/3s2+HBgP4L/MAlIhhLAJ3ySEvattCxLC7De7STtgxWS5pAyvGa2hAdRX0RXNrE2/cxL5nAXTjhGB62YRPnPc/gMPSe9q70zc/C0JbgvOcwlUSkpVVkjEuRT2T2Bm3plLrNE3XreMLCW3+hEM+Y0CmYegXL3jSrMKlL73PD14OmNuo4L2KtHhJH6WUHcTJuURsWl3XDZZmV79cj/EacPrNSgCiwxxmlZzhrG7+42KzsxqSzSH/uWK2f0oOcBMZrw4h9U4BOpGcNU1XBbZSohhEJZQhZ2DXGmm0GeXRkJHrS52q0xkCOy0ygWWA7a5cB1+GTcvoWUMQvxO5gh548a6OavqIM73dIcpyC7nHVW4u07vFejLg7hDVxZlB0hIWUEqSb/tp+Z79OIjWioa0Ocz8LbZj6Mzf0zRXKzdFog+FxZ9LwgBfokI7uyFAcGNVXCP1mp7NCyuMzgs8z5TQIOQBTIpC4p6HC1VkEDWWUfcASS5VO1TpLF8uXy1rR6YPRQv47HaMpTP6haZkRfSKCAHxXZrpRXYwwtCUnkmX4XcxKPBmAFk/2w5ScwdAiThwEM/j3neaRHX5Ec45KzGa+xfsyX/nm4cppcLk9vuToQaAkKJAolnpS8J3E/2CxlALJnC/heBwk9yUXecEYtTBSJDu2gaxtNaGIa1p+yT1okZtpsld/v1lLoErOmfyMxliMG3uwPKKtJu2uy9JDowt5hXaOuMk3qJ6ZSf0bVJEkC7yx7Fa8xV70lwmz56e7SZb/mrkpe9iLDz6U1j3VjlmOW4APOY2QKMqmZ2Girf2VD53b0LkyKRcpvy6OnhHw3obBRt1Y8vwMBmUUGUWYTiDOyZemJw1H+4G0Sxe9KKbI+hc2pTOtiLOedWruA33gB/RZfxNISBjD9Cf2lQpYufJe+IEjwimlpvzU0a9bAQ4z+3SHQG8MT5QbAd74yZNX36D8f1DT6sS8g4d5fV7c8re+QhmcXPtcpePFNowiXgo0IjmQ0gNq271Ips34TfQCPwslYx+wlbvZL7I2+7GRKRKZ0QfvSrL/DWM+f7ZbqQoX+CRiETlUVeHnJIA1R0xYJiZjPIW2g7jXSdoIKdDWQt7TCTjSOvMmz1pPNpK6CEdwXUP2R2geZQx3587dbzhSr9C17Kh1H3RskdYB07s5qI5GK9+Yz+/dBIxDhKeSlTkXtD7Bw3ymM+LcMP4WezhUGFfGdrp7NZgY53ismGL5zqaTsClbt3ZwskTZWzd9CWGG9NM0YoxTb69M+hOY1Z6irGQ/lj4f8QqKiG+8ESk8sBF1tvVO+n3AQOUf8myOUQ4HlqSWw6pTZyrOP2yStNl2AY0oVvPAQxvywD7e2rW9yqBID8YatsfjCj6MQWnsAd4eOn7BL09zUS0wuqtrslx1hsegoV+g/0cvOjvXjFI5yX5NJsKiLqjk6JzuHCSKPnvPx5knVNFC236UOo+9rT/xU53gp7Emd/P4+wn8U6LdYfLxX9FpAKPPf5KO7xV1ZKqIJ0IDXBI3xnaCrKEoZbW1s86k+GkW+g9H54FVw6fgpwzn5/0mz6Bi9nOUr1A1uV88mQAVtT58+E+rY4/4yulN67z33wPDwEBhUdvGpUmvPXKh50cEul+8WstA0GorN246isOKas1HsPkVWzQk1tbRSdtPBRqPtw2yewyAruLmbZMAfPvSKjIXHNkqTJ8uvKgZ4rmWAbIZHp3z79zpw7FreDlSuUF/JDV6DueDFofO4foY8B0Pc5h1x/6H3qtchnCg3iK6BHw0er+wnl0Sp4QvEYVPl88iXGpPbsw1/pDMkZ8COtnaQIxXyX7/++pWBaiwNW+UVwY0VoiNh8zlLDItuJmTfwoyumha2PtPzyW1nVuSSr9zbMaBFQ20A9ZNtXrr5mNJa3YE3ltlOOSukc4HxeZen+v+gs++iFobdbjbKN3qGMl0YxEDqbH80WeMvjsDe7VgP5CFsDdUi0qqgrTp+CIUKPqrT6UzzHvatZpnWu/84C+YWzr8TGs546NH9SFdJyuTa0+D/6Iei+B27h0HKXbk0TW+d79EuNv7gaGGBQ7yVvG37cYXa1xGeRoIO1pQfvZ4+0uDiUP+oRlX6fi2EmD/+BGLYZ5wSn0L24THcG34IC0I+X/T6Sp+13fHE038rJtqeiUQ62wYKPI7bN5ZCIx28Q2hArzTmYz4YuqVVHLUEEDVp0OCT8NTXRkZSk0Z1pE8Ahv1F10HubepUcOMeGdUNBqw6IRQnpe/9K+u/PDBGVCHbLy8M4yCauesUmmDDCJY99ZNrs58ryZrpm3nNi0xN2TLPN7IPDF/xiJMKRmPr3Rvn+6muZNSLXf1yh52nXrITnjqI7y8M3QIYqp8+WTSfY+hl6MZHfFLWPhRDJqUgpkqDGFIMBlRi/6iyfQtYpLbJkqWYbLwzr5/IQWML/Q1RiimnKrmrCqRUWds9YxfzSHHYxIQHKTPKxINqavTZcR/enS14QAz/gQpx12iZsUqIWm9+Kxvl6jZ5qVkvTZaIGsiRn51oy2anU1MxG7IW78Iy4xV3JiSjDVnRUvF1r8DDGs7CFYndILEIPafVR7HsmqMrrd/CwEkFBWepkHYZ5PorxZlDoyefIjzWSKNrW+AWB+zcwvC+p8QNMnxtjsUyr5muYQjWSmuJu+ZCXNKtO3xYRJC/aqemmqyYH3aynyxOa6UXHq26Ki93Y9d/H+FG50qT0ViHXoEhPRJgFK0LeTlHt9bOOWH31GgKnOZOiqKmEh4tHLnWohOq5g5RCv3TAyOnbQt1GBCzqij1FLxRtB8IANNDZEmDL9p1sQtrY9o/137+gzuuzhZi5nFmdIChIsUvKwoszYHUfMkJ+Pmma1BoQ3jfzAu3LQ+s1SIXGS9YQ1SSMp5sKzaZamQPD0sK4dKIxeWplSOxiAyDjJmRJeGbpziVG5YZnGgsuDwkWH9b61PKb5MSnDbR+0RmIA+g212o0/zdhtzf811X4gxs3NW3CA+DfJS06flDAofpodD1qQWL5lesonsRdvPO5OBhobskocgowYXKkO0mV7lvqw1InQ0R8sgOLYjxuzaFshkYRe/46A9B4UGa95JKfRDG3Eex6ljtuyMVDmPHWhcAuvw8xHbTRcgNr1yw/tvRN5cXbKCdpbO2hAUfApyP5HmAgA/YMRCsWXcv94utX3GxNoHgCXN3XiC28fQQNjMuppgUJnWry1GtkX6nvAffWFdOM1wYCqTJxTaYZesRKs99IEUWA6GU2iO87K8AhK7XMkgZAXZaT5JHMYF</asf><csf>2</csf><pub>MIICIDANBgkqhkiG9w0BAQEFAAOCAg0AMIICCAKCAgEAuzT52XaLWEJjHAX1xjv0OLVqOHnxyvUyUVgb0ljKTm/CY4eMa/S7zFajNSxWwdrs5ZBQsmJAFzjpPqZQHfOeG7SbHBMEouH/5nymSYdu7/Kzw0d+H1+r6R5pMiDpHJ2MellX+t3aI4WdyVea/L06U4vGsbc40O+SyQLDC+KRF44F4x6E/cDzt3jc+vyTsJMo42pXJf8VkuKbuX8nk8rTvinFQfHr2SzOCt6PGUk8mLTJd0HwMueoSA+e9GUMo5bdYT57ZyV43ZH1IyYgY12QxMBgP5lJC+UTTejhQRuxfaM0uIH4LTA6wXz4uk4DmNspctrevaLMLlEOqqg9FUtFgzj6XaZWKiBx1uaz0+VPVUPN/S1WPgsOwqXDcGAjK5dbquOKy39737WaSvUcIEGEgHNlOtEJL9xpd5sogoRP+8zcpZOt18FhKfbSZgnInLMiTHPUyO5PMTp4IiocBPFoSYrBL4uBQElNYJSYWKCWoV9NwB5D9fqrFEiyl4WjnA9vK/9Bq+YU4CYbfXkUgCE3PEDs8iG4mzhVH6Bx79WZj6GT/GwN5pcr79CkG9ZZM2T+JFc8NQKcMHHXdk3GlNmOzg6AzhMvuKOjJ6CD4iklaC8oxQSyyB1m8nYuhCl3b7MrB3/TvJDCeIllP3eSwq1ur5pMr4D2QAA/4X93t0rXFbkCARE=</pub><bsf>WAYEYPDI</bsf></span></body></html>
Emails

Extracted

Path

  • C:\Users\Public\ATOMSILO-README.hta

  • atomsilo

Ransom Note
  • Atom Slio Instructions WARNING! YOUR FILES ARE ENCRYPTED AND LEAKED! We are AtomSilo.Sorry to inform you that your files has been obtained and encrypted by us. But don’t worry, your files are safe, provided that you are willing to pay the ransom. Any forced shutdown or attempts to restore your files with the thrid-party software will be damage your files permanently! The only way to decrypt your files safely is to buy the special decryption software from us. The price of decryption software is 500000 dollars . If you pay within 48 hours, you only need to pay 70% off dollars . No price reduction is accepted. We only accept Bitcoin payment,you can buy it from bitpay,coinbase,binance or others. You have five days to decide whether to pay or not. After a week, we will no longer provide decryption tools and publish your files Time starts at 0:00 on December 10 Survival time： You can contact us with the following email: Email:[email protected] If this email can't be contacted, you can find the latest email address on the following website: http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion If you don’t know how to open this dark web site, please follow the steps below to installation and use TorBrowser: run your Internet browser enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER wait for the site loading on the site you will be offered to download TorBrowser; download and run it, follow the installation instructions, wait until the installation is completed run TorBrowser connect with the button "Connect" (if you use the English version) a normal Internet browser window will be opened after the initialization type or copy the address in this browser address bar and press ENTER the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or use of TorBrowser, please, visit https://www.youtube.com and type request in the search bar "Install TorBrowser Windows" and you will find a lot of training videos about TorBrowser installation and use. Additional information: You will find the instructions ("README-FILE-#COMPUTER#-#TIME#.hta") for restoring your files in any folder with your encrypted files. The instructions "README-FILE-#COMPUTER#-#TIME#.hta" in the folders with your encrypted files are not viruses! The instructions "README-FILE-#COMPUTER#-#TIME#.hta" will help you to decrypt your files. Remember! The worst situation already happened and now the future of your files depends on your determination and speed of your actions. AESKEY
Emails
URLs

  • http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion

Extracted

Path

  • C:\PerfLogs\README-FILE-JTAOFTKV-1770377583.hta

Ransom Note
  • <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Atom Slio: Instructions</title> <HTA:APPLICATION APPLICATIONNAME="Atom Slio" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style type="text/css"> .text{ text-align:center; } a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #f3f3fc; border: 2pt solid #bda; display: inline-block; padding: 1%; text-align: center; box-sizing:border-box; border-radius:20px; } .h { display: none; } .ml1{ position:absolute;width:50%;height:10rem;left:-211px;top:0;background:#f3f3fc;border:1px solid #cfd3da;box-sizing:border-box;padding:2% 2% } </style> </head> <body> <div class="container"> <div class="header"> <h1>Atom Slio</h1> <small id="title">Instructions</small> </div> <div class="text"> <span style="color:#f71b3a;font-size:40px">WARNING! YOUR FILES ARE ENCRYPTED AND LEAKED!</span> </div> <hr> <div class="info"> <p>We are AtomSilo.Sorry to inform you that your files has been obtained and encrypted by us.</p> <p>But don’t worry, your files are safe, provided that you are willing to pay the ransom.</p> <p>Any forced shutdown or attempts to restore your files with the thrid-party software will be <span style="color:#f71b3a">damage your files permanently!</span></p> <p>The only way to decrypt your files safely is to buy the special decryption software from us. </p> <p>The price of decryption software is <span style="color:#f71b3a">500000 dollars</span>. <br>If you pay within 48 hours, you only need to pay <span style="color:#f71b3a">70% off dollars</span>. No price reduction is accepted.</p> <p>We only accept Bitcoin payment,you can buy it from bitpay,coinbase,binance or others. </p> <p>You have five days to decide whether to pay or not. After a week, we will no longer provide decryption tools and publish your files</p> </div> <hr></hr> <div align="center"> <span style="color:#f71b3a;font-size:200%">Time starts at 0:00 on December 10 </span> <hr></hr> <span style="color:#f71b3a;font-size:300%"> <a>Survival time：</a> <span id="td"></span> <span id="th"></span> <span id="tm"></span> <span id="ts"></span> </span> </div> <script type="text/javascript"> function getRTime(){ var EndTime= new Date('2021/12/12 00:00:00'); var NowTime = new Date(); var t =EndTime.getTime() - NowTime.getTime(); var d=Math.floor(t/1000/60/60/24); var h=Math.floor(t/1000/60/60%24); var m=Math.floor(t/1000/60%60); var s=Math.floor(t/1000%60); document.getElementById("td").innerHTML = d + " Day "; document.getElementById("th").innerHTML = h + " Hour "; document.getElementById("tm").innerHTML = m + " Min "; document.getElementById("ts").innerHTML = s + " Sec "; } setInterval(getRTime,1000); </script> <hr></hr> <p>You can contact us with the following email: <p><a href="mailto:[email protected]"><span class="info">Email:[email protected] </span></a></p> <p>If this email can't be contacted, you can find the latest email address on the following website:</p> <p><span class="info"><a href="http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion" target="_blank">http://l5cjga2ksw6rxumu5l4xxn3cmahhi2irkbwg3amx6ajroyfmfgpfllid.onion</a></span></p> <hr> <p>If you don’t know how to open this dark web site, please follow the steps below to installation and use TorBrowser:</p> <ol> <li>run your Internet browser</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER</li> <li>wait for the site loading</li> <li>on the site you will be offered to download TorBrowser; download and run it, follow the installation instructions, wait until the installation is completed</li> <li>run TorBrowser</li> <li>connect with the button "Connect" (if you use the English version)</li> <li>a normal Internet browser window will be opened after the initialization</li> <li>type or copy the address in this browser address bar and press ENTER</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> <p>If you have any problems during installation or use of TorBrowser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the search bar "Install TorBrowser Windows" and you will find a lot of training videos about TorBrowser installation and use.</p> <hr> <p><strong>Additional information:</strong></p> <p>You will find the instructions ("README-FILE-#COMPUTER#-#TIME#.hta") for restoring your files in any folder with your encrypted files.</p> <p>The instructions "README-FILE-#COMPUTER#-#TIME#.hta" in the folders with your encrypted files are not viruses! The instructions "README-FILE-#COMPUTER#-#TIME#.hta" will help you to decrypt your files.</p> <p>Remember! The worst situation already happened and now the future of your files depends on your determination and speed of your actions.</p> </div> <span class="h">AESKEY</span> </body> </html><asf>vyc9RVFnauPOrCc1hMzsWRKnRqroe+WhWkUQzIOzTEP3I8Xk2p6geEYfcTgld54cs5k9BytsKQrrNL8WL2tohHwEKnDGcjhg97PAV9JNxcRReDaIugdDdNzaJDa4ZS2kyUIyzOx+9VuLN4+u+BdQAlTripwwvYpSayaMUQWr9R9aFE0tkP8F2S1M/rSS2YOCkZ5YV8+QBfd8doFSfM1WXKdEa0MzYUzFEgKe7uHJVZ60fOSqgXBNJY7YMlCPW89e+MusjIXJzPlIoQIh+G69JIoLZLeUmF/2fwSGqDtMjQeS2y/3vFPGjtVbKZJ0vyKHCbQndU78BrfceR47zf7MPEF7BUvP3XOwQ3jkdEI+TObLllQwWLBzsS1+5kDuAdk6plW3OzdmJOjdG8NZMCZ8ye6Oq9WB/PiLpOiy8/wiBUSsZqYaYHl8OlMtEISPRpBhkNcQQ/V6KEgn8BKpHImZvQD2wol7xwJ1q1V+eTyDZAHQ8mMTJnNBAy4zCXhAJzJO15/r1Ua327nTiYcSlk+qbcq/OT3CqPwQTKyizN4WJP1ZfhRxszxLXS0IzDUFYrvqd4IX8aHbOZ9RWU/gvHq4PQ/qV9YCKvltS+tYmOV5IYiloPKBCjs8VuhpwIdDz4Ba7myzcc3mSBE5vcFXdrsworx0XE7k4FOKwqOqzho9b4dLok52ZFN6GJaBV7maH7FsDVVnKDnToa3dzVpXxYpbP42DOVr9LLh9oiAG6jMmEzDd84oAq6wijelD1O08O2VF5wj/QGefRL1NP/pfZYSuPwmR8zF1Xd13EdmOg41CaPyL04vMlAqApypYlNsDNvFaQdi26249M0T6MOPS/53rpraL188hCrKSdKFGGkRgvpxNnTRm59AF0qrfs/7hvdhoBGhqR7Gey2eKQFkTtnjbGtWVX3ZrEoF/gxhi8lx7mjCzfdquzaPKtB3Jwunxj3A5wTI3OrpkkZ5gF3dHvxUSIyfhKEl+pdJwup0xrAe/BjqCHRQebnTDwhWX8VP1BKcPiYNWakGHYlSBxiPsL+9u9+3szwn0Clqj+WObNA3QMvpN8W+y2EG6Bjwn7rH/R7v1nlEYQt2VHf6QFd1NNrv049JnYbJuvf71Lh0R+ScVhgDDCaUGdBYSXxjE11XJNjG0xksal2Gte9Y7F8DLakpQB1ed9RStx2k1EBobSDZWAsRlEtei4SrA9YobqHPMdtF1PNDQbc/OSUDCNslqwVOncDE6pjNeJolj2N0GMNIPHz9bQbGZmLnOJprv0nTvSLhVnCIWNP6DUv25ZuPKIaezBBl6l9Xn1DadEXAC6zBU+4oX0EUebespmCg5De7yliRm2W2G8Lcxa/JQUQ/D8XMpuwcQjC65DYs4ZhQKU9a1ZiGlhn/5MrcS4jr97bvautuVR77XLKEItS7aYLaJLJHinDCLIQw4VXYN8ALu0QYxas94INVtIPfJfd8guCNDtOlOsOM0xOTTE8F7cWOrEa8UgYUOUPLB2jhKTzaMmY3E6nNU7ACr9y3OiZTbqvdSFbOh999AkIPsTKVwA3rhM9ibVl2qiNfm/Y42os39Z2NpQEMtR3Cyt+z2gyRK+OO9Yz7NYXWqiG1IcTczDKeAhhmw8lliGb1VOUcSmTz0rsUgU5CCdMlRp62FHwuyjXxlSPLoNkW+EVzhyuKrVMMi8IZ6bkrDBjehEPNau7CWE/Q8ewymAO6Srue/33AzKC6Op8woOvroOoy6mohD7jWdM8sjt7LIId57MUmHI47i15AjFuDieBSq7Vh21JQBRQQHkf2P0KK8+8KCmvCt91wsCfyI8ezIdUF2Q3Zi2hf4ihAkZLNy0NdujdYilqCTyiT7GuQwXntD9PVx0IhZIlGX2WZ5vc92V3D4VKCv5z5TcK9F7FRi03X+zDt8qMn8JBt4ofGTf4xyIDWhwjzIlyA75BaUIoe1x/V77YkG9QU4dEAg01gTpA+pCAsOU1eGq71txGAy1I5FK7/3Y4HyALymjFzbojS1StSyqTXm6YOEJbyM7ZFeXH+R1KO9s4nhkD7vtGGkPEO6GEjuNeVpqkhnMZqSZx9TWl7w0DD95/22KHduR866AQ1MlBQHP6Nus6xWFI6NrvlHZB00BVZr7DkWCtebRlHasFwqzw9r6wpVtDO2cHglugKOhpDk+Rkw0Qr/olQ3sY88RduHjzsS9//xbjBXElZjnOtYsH2JS2yPAt5+9EepLwmvGwE/7WEUpiUYCOYb3bJJJTHQh3Wh9t4xl1IoW2QhgMSiM5rU9aA6QfL83VpmHUNftxnh25eMq+oZVD7pqLWj5mVb3P9xSp+e+AIYlvBU3k0zUjYg/VIUEP+pS6hzh3qMIIq+J92numz+LaY9S42POjrl4rQUUV7qNGPYzW6E+7r+hsdlyGlBFVpiMPLJIpJlVZZKn+JxwAZ/aTpivy+BM3sSVvjBh+Gv7q/WVKpdEtWXU3TFm543f8qlsKaHnitOzpB+7rFeSO1OkVG/A/EsJ23ypz0+B5MFiNkZk1l/zyMoC2QrV0Kw7gr0GOu52JWDUIPocKknFHWr+cQV/fMIp19gXY3OKysNYf1sQbDMHSF6JN66qaxZXyRTRhx6/o5Z0J5FmRvuXI2xFRfYJVUTvHjn/zZYc9mffQM1+TYUk5Ax7wyvsVJ0WLuLpJOWpAxt98NYb4oCHCr8HxoMekHw0+HNlHDM0ag0x0FKi1iY8rGFFzIOjN6VHmAQIjETX/ye75MCfLt46PC2TMGMb2wi3LQGxG3h4wFss8jUP3xgmsM30UCqxj9wuuF4CnlP1SlcgTF5OiirHpnEBLfig2Aboi9eivdu/S5/cGi3Ouj6/uGPybJRIMmyRP7GvI9WMbptPbsc0E7ws7PgyoZkWT/+1zlp6NSPn2OCaT5faZxnQmwfaC186XA+Hd6XvatK/eK3iLD9xoqI2OJhzOVuIKAEJaH4vt0ZYP+J7D+umOJpaNxEhl27uvyMwHz2DOl6IxCwmGs/2BqHEk2hoaAryo46Tj51gquGzsgrlJQPwina7pmVA0ckx82tWyxWot47kjgcVGLrFhmOtnYX6Gm1zofgeTKVnOqaFDDsPYB2mih1LObnIVpqp5jzOkTECiouSkysCbc/BT/8oKReqse3XGiBQOqr+9amSzjnmsbTvjEwIlTRtRyBdgxfT4YamOsSRdQ4Pg83GUtBOs+1/9zLFDLvgwbQhrzNh0EF8wwu6r8FyNOydUI4knBl9KOhHmn5CcFTtpfSPdLt0jP0aaQ/y6ksRI9SGJ/59rkNTY6yhnp8kJG5nhUFQfxt26dbVH4VbjunYzRM1sVPxedzj2ceu32Kh0U/iSFHLkObuyVNs3ObUG0gVGfxvSTprQ49ftk7B89I+cVT138bd1ADZx7rQL4jbAOALXbtHlsc9j3hx+VjxqOi2ClNI5iPtN5JxjCsP1CKx9YhiKGgNPENep3yfpIvV+dTwPBuKTy/grdzrOrU8LngOqaE4X5iGp9M4CC2AsB2vkCdUjQ+YyHCKOohNUliRAHMLfyMrCQ9R3ruaoDDcxTNNaR0lLectUbkAkDJBXgB2Ea9cI2xSdqVA7H+/6QJ9HpMCYIKNKt81BL/4KFbV9ED7y7EdUVwctqQKnUAoSXwgdo/O7SZ/tVWFnIb1pyR9x+/7vb1EtPApNj3YF1gl7BjGJOz0A9L14mpF21HfymY1EL9sDEiW7kpeY4o5i8AhVfS8o/vXKok5/MSrjj7tgZ8etA0an+Qme+tqubVMPFywDA1PuCNGvWXYpUUAm3YE0csrhcGQzVBqScZ0paJP7lIXnh3ejMy5+HUvf9wrULnZ2nVgLQzKhWgeJYkHg1PhLiAOVnQB+yYd8yJazmukEF0Jj7g3NC/v7rfBVKpLY3WjjPjMBJkNodfntlKEIaZfLNMWsBd2IIjNFSr94gQETcon/cFkwcCw3iRXa0e5iboOlwNjz4lyOQHfZ2As61f4VTS9N9Dr8VzK3OoJBoDedhNNvcGMgMMws9jY5Hz49gsvemh7X/M3ZOpSrVX4xJVwlMIAfb4OyIPLi8wm4CHlaYEE5/aOnXEdPFWKoQgRD6VnjdQCH5JzIYrBmak</asf><csf>2</csf><pub>MIICIDANBgkqhkiG9w0BAQEFAAOCAg0AMIICCAKCAgEAmM+9zoIgrvsKBQOlP3CtoGalaU7cr/tGJuZSIH59TCQiV8hso22R5kfTDz46WsduEz/w/rDae53fIV+eKaTNLo9DMq9ebBny7TgpSav9FSl4N+5SqeJh4Fo4NA9fMs8pqUVZdgOHN2/hWiHciTHyDnni/xuusREMG3hATjsudEbXCtlx5MN++7Msw1RJwgvvd1rcZ3/EPlIMLa7nauepyPPLa2KolcxCTEt4yXBGXnkvX9V2BlYnrMspMgCvytF5y5o020hUmuWhS9R4YO9W0K5Ztw5DP32zo26YxEQNy2v7DCu+Dhrnq9ZdXTZ3ojwve6yGnu2L7acscdfKhjsPzLGfwTqQyWIRsAAbFVU6ZpOAPXqf1Q9BLcEgs8ESPMWIRM9j7lKrOpBZ00SerMbX8T88dN/ZrGesLwS4mbD8LJa6ENVJp3OHRAbeAkCTleyR0p19jbGPTOgI6Q8MQEz+3CNDAhnRrBRGtzeLoSPWddr+adM4Mxqj+taFcTtccia9x18sFpAojr2O/ZIdVHHYLYGMTg2GBTnygFM/zrnXpB7VFP6BhRHxCkvSKI/ZjZCx5dG+rW93w7WIzrMkZ0xrXKlGN2D3RqCRYxOaGyKkF6g9p5ZFf7dB9vksj3F3XUf6Js4xkIusu7o/Ovf/hqAHFYumsNceDBqkaMsApRF02i8CARE=</pub><bsf>JTAOFTKV</bsf></span></body></html>
Emails

Targets

    • Target
      5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4.exe
    • Size 6.0MB
    • SHA256 5f614a8e35bd80a603cf98846c6a44030ad18bed45ac83bd2110d83e8a090de4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdiscoveryatomsiloransomwarespywarestealer

    • AtomSilo

      Ransomware family first seen in September 2021.

      ransomwareatomsilo

    • AtomSilo Ransomware

    • Atomsilo family

      atomsilo

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Drops startup file

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks