General

  • Target

    net_shares.exe

  • Size

    114KB

  • Sample

    210423-cd6nh1cmla

  • MD5

    07807a9e2aeb0ccc03d88debebcdd2eb

  • SHA1

    13a93e6e785d8f42f062b55fe5ea1ba9e0e139ab

  • SHA256

    1136907e76399f1d76694ee9c540b387ed6a5b12340b60f3fabfc183bca457df

  • SHA512

    1cc1ecab6047c7cc2e81b6b5a9266c25fd9d2a7d26865c0e7554882c0f28f47453fb3c6abc9a613f9af62cf4dd456d079da67897459c9f4d88adb7715547093a

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Family

makop

Ransom Note
::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in Bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: Please, write us to our qTOX account: 7BDD546F7524089A930B12F793F4C1D1B4470A15A4CBA85AA0DA6D030AFE2E48B8799204F004 You can learn about this way of communication and download it here: https://qtox.github.io/ Or use Bitmessage and write to our address: BM-2cUbGd124Dcs1Jdc5VfSa2GDMC1iaNTesC You can learn about this way of communication and download it here: https://wiki.bitmessage.org/ and here: https://github.com/Bitmessage/PyBitmessage/releases/ .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don’t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. Key Identifier: Hp2bHm6JESUz+Xvf1IzuiHC4ygdrS/Rhu0Mu16x5G50sEfoOtA1R36MI0r3gYdEuNBZYYvq29+u51MdAwQm/HxqinyZtpamwkKt8R2UA8EbNA+TZ/L3YvaI/2ET3f/vhKEKJOxpj7ehAIsFQS2z+0FNJrc6uHMtMZC7vtppBH9PHzE0UrkJP/Dcq7kEfyJZ4+LmPQ/1V9ywqxsbIF3uxOOZFDFD+HsPd9dneN0yWeonDzma7r2M8794QH16aaYUoZu+59qf0FML86RnxCFWf699sceMMkT3VBt/5jMwxjfyIAgLanEYjza8OAi184ozXN8JOMBj2cDFIXbGG6dCWuVKSFuBdbQVveLgQuAIyLjIir2wcJTVFbDZ0UkzT914Yc6zujuaF0guu0JsiKzoAAQT7W6JExepNAhILRKTI/4ZNcC0E192zq0fGU3oR8YpxqHW9/z2tflJZw89KMdREETldqMZgtHgRO7FlwXYCLI6bAJXHuNFdVovaRpaPfEnTE+QA9D6TknURMsPvSd0xqNaAVH2djCr49wWLGR2N+kPuKwaSTZki5S0IC7DXfl4x1IekTTSPJqKIGhj4vdNllkjm+4VihEvTRwcebB7H0ri53hfr3ZHMQRCCx/nynZ8P2I1X2qw0WjjPuvwqIeupTT9hHXt4sIt3ytYYoTCZboI= PC Hardware ID: 40707513

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Family

makop

Ransom Note
::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in Bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: Please, write us to our qTOX account: 7BDD546F7524089A930B12F793F4C1D1B4470A15A4CBA85AA0DA6D030AFE2E48B8799204F004 You can learn about this way of communication and download it here: https://qtox.github.io/ Or use Bitmessage and write to our address: BM-2cUbGd124Dcs1Jdc5VfSa2GDMC1iaNTesC You can learn about this way of communication and download it here: https://wiki.bitmessage.org/ and here: https://github.com/Bitmessage/PyBitmessage/releases/ .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don’t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. Key Identifier: Hp2bHm6JESUz+Xvf1IzuiHC4ygdrS/Rhu0Mu16x5G50sEfoOtA1R36MI0r3gYdEuNBZYYvq29+u51MdAwQm/HxqinyZtpamwkKt8R2UA8EbNA+TZ/L3YvaI/2ET3f/vhKEKJOxpj7ehAIsFQS2z+0FNJrc6uHMtMZC7vtppBH9PHzE0UrkJP/Dcq7kEfyJZ4+LmPQ/1V9ywqxsbIF3uxOOZFDFD+HsPd9dneN0yWeonDzma7r2M8794QH16aaYUoZu+59qf0FML86RnxCFWf699sceMMkT3VBt/5jMwxjfyIAgLanEYjza8OAi184ozXN8JOMBj2cDFIXbGG6dCWuVKSFuBdbQVveLgQuAIyLjIir2wcJTVFbDZ0UkzT914Yc6zujuaF0guu0JsiKzoAAQT7W6JExepNAhILRKTI/4ZNcC0E192zq0fGU3oR8YpxqHW9/z2tflJZw89KMdREETldqMZgtHgRO7FlwXYCLI6bAJXHuNFdVovaRpaPfEnTE+QA9D6TknURMsPvSd0xqNaAVH2djCr49wWLGR2N+kPuKwaSTZki5S0IC7DXfl4x1IekTTSPJqKIGhj4vdNllkjm+4VihEvTRwcebB7H0ri53hfr3ZHMQRCCx/nynZ8P2I1X2qw0WjjPuvwqIeupTT9hHXt4sIt3ytYYoTCZboI= Number of files that were processed is: 505 PC Hardware ID: 40707513

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt

Family

makop

Ransom Note
::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in Bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: Please, write us to our qTOX account: 7BDD546F7524089A930B12F793F4C1D1B4470A15A4CBA85AA0DA6D030AFE2E48B8799204F004 You can learn about this way of communication and download it here: https://qtox.github.io/ Or use Bitmessage and write to our address: BM-2cUbGd124Dcs1Jdc5VfSa2GDMC1iaNTesC You can learn about this way of communication and download it here: https://wiki.bitmessage.org/ and here: https://github.com/Bitmessage/PyBitmessage/releases/ .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don’t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. Key Identifier: Yfu9lRJF2zjdaAa92VfTp1QVz/xFKhqLSwxAUSKyJXOzyoGCxDecvSpYx0j2N74vudZag2pQYYQ/K3O1W7upb5Km862FoXeTWhSwRLufOQi25KATv2dFr3T7nXPa0g6mg+VgL5jYtAAQc1NgWP0i3AjIJVoObCjuO/NyAmLiT2szUM+USI9bsmaQ/HMCOUekA1drmJgwWWohMf3NO1IsduA5cdPNTuprB+6YKDpC8/vib7AOPU5xOx89omVDb7HXUXRm1TNoNeEZi+DcEZTkXM7rKoxlCqHBBe6CqoRBUStdj3EMl+MyjGNOHF0DnysiTTKvgVGV2b+l8j40aNMKZ3cIK8gXRLNMVeN/Dlt8ZHhlQ2Intcf1sCkZV1XUAjRZ+WB07bmkdLii4DXlFB2d/rPygsznmrUVAIZQ6ScT/W3UFl2T3dB0OzOUbOfTocmt+A1yZDsJ0Fu2OUCaxY1uBnex6Fkjh7Swohvm9VaNjUuk58Ne+gvadjWFxrurFB5jZtwTFE081GDRkyJg3btLvh2w8tgbx0VAZW3XQql/lCvH8KdgnRbjEw4dqikgnfH4TYj2LoewbBrY5z3vohjJNmWD6Wptyq9kLuncsE+9rIM/hra5iHtWbuIcgbz9AyuGVG361sCeQThqU1Rs+RWKVVm3Bir1KSzWd6tlsgRdEcg= PC Hardware ID: A2C56C1C

Extracted

Path

C:\Users\Admin\Desktop\RESTORE_FILES_INFO.txt

Family

makop

Ransom Note
::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay in Bitcoins. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: Please, write us to our qTOX account: 7BDD546F7524089A930B12F793F4C1D1B4470A15A4CBA85AA0DA6D030AFE2E48B8799204F004 You can learn about this way of communication and download it here: https://qtox.github.io/ Or use Bitmessage and write to our address: BM-2cUbGd124Dcs1Jdc5VfSa2GDMC1iaNTesC You can learn about this way of communication and download it here: https://wiki.bitmessage.org/ and here: https://github.com/Bitmessage/PyBitmessage/releases/ .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don’t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data. Key Identifier: Yfu9lRJF2zjdaAa92VfTp1QVz/xFKhqLSwxAUSKyJXOzyoGCxDecvSpYx0j2N74vudZag2pQYYQ/K3O1W7upb5Km862FoXeTWhSwRLufOQi25KATv2dFr3T7nXPa0g6mg+VgL5jYtAAQc1NgWP0i3AjIJVoObCjuO/NyAmLiT2szUM+USI9bsmaQ/HMCOUekA1drmJgwWWohMf3NO1IsduA5cdPNTuprB+6YKDpC8/vib7AOPU5xOx89omVDb7HXUXRm1TNoNeEZi+DcEZTkXM7rKoxlCqHBBe6CqoRBUStdj3EMl+MyjGNOHF0DnysiTTKvgVGV2b+l8j40aNMKZ3cIK8gXRLNMVeN/Dlt8ZHhlQ2Intcf1sCkZV1XUAjRZ+WB07bmkdLii4DXlFB2d/rPygsznmrUVAIZQ6ScT/W3UFl2T3dB0OzOUbOfTocmt+A1yZDsJ0Fu2OUCaxY1uBnex6Fkjh7Swohvm9VaNjUuk58Ne+gvadjWFxrurFB5jZtwTFE081GDRkyJg3btLvh2w8tgbx0VAZW3XQql/lCvH8KdgnRbjEw4dqikgnfH4TYj2LoewbBrY5z3vohjJNmWD6Wptyq9kLuncsE+9rIM/hra5iHtWbuIcgbz9AyuGVG361sCeQThqU1Rs+RWKVVm3Bir1KSzWd6tlsgRdEcg= Number of files that were processed is: 1868 PC Hardware ID: A2C56C1C

Targets

    • Target

      net_shares.exe

    • Size

      114KB

    • MD5

      07807a9e2aeb0ccc03d88debebcdd2eb

    • SHA1

      13a93e6e785d8f42f062b55fe5ea1ba9e0e139ab

    • SHA256

      1136907e76399f1d76694ee9c540b387ed6a5b12340b60f3fabfc183bca457df

    • SHA512

      1cc1ecab6047c7cc2e81b6b5a9266c25fd9d2a7d26865c0e7554882c0f28f47453fb3c6abc9a613f9af62cf4dd456d079da67897459c9f4d88adb7715547093a

    • Makop

      Ransomware family discovered by @VK_Intel in early 2020.

    • Modifies Windows Firewall

    • Drops startup file

    • Modifies file permissions

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Tasks