AtomSilo Ransomware
By Chuong Dong
Published: 2021-10-13 · Archived: 2026-04-05 19:22:54 UTC
Reverse Engineering · 13 Oct 2021
Contents
AtomSilo Ransomware
Contents
Overview
IOCS
Ransom Note
Static Code Analysis
Cryptographic Keys Setup
Run-Once Mutex
Launching Encryption Threads
Encryption Threads
Dropping Ransom Note
DFS Traversal
File Encryption
How To Decrypt
References
Overview
This is my analysis for AtomSilo Ransomware.
AtomSilo uses the standard hybrid-cryptography scheme of RSA-512 and AES to encrypt files and protect its
keys.
Since it fails to utilize multithreading and uses a DFS algorithm to traverse through directories, AtomSilo’s
encryption is quite slow.
The malware is relatively short and simple to analyze, so it’s definitely a beginner-friendly choice for those who
want to get into ransomware analysis!
https://chuongdong.com//reverse%20engineering/2021/10/13/AtomSiloRansomware/
Page 1 of 16
Figure 1: AtomSilo leak site.
IOCS
This sample is a 64-bit Windows executable.
MD5: 81f01a9c29bae0cfa1ab015738adc5cc
SHA256: 7a5999c54f4588ff1581d03938b7dcbd874ee871254e2018b98ef911ae6c8dee
Sample:
https://bazaar.abuse.ch/sample/7a5999c54f4588ff1581d03938b7dcbd874ee871254e2018b98ef911ae6c8dee/
Ransom Note
The content of the ransom note is stored in plaintext in AtomSilo’s executable. The encrypted victim’s RSA
public key is appended to the end of the note before the files are dropped on the system.
The ransom note filename is in the form of README-FILE-[Computer Name]-[Starting Timestamp].hta or
index.html.
https://chuongdong.com//reverse%20engineering/2021/10/13/AtomSiloRansomware/
Page 2 of 16
Figure 2: AtomSilo ransom note.
Below is the full content of the ransom note file dropped on my machine.
Atom Slio: Instructions