makop

General

Target

ransom.exe
Size

34KB
Sample

210601-226edze4ba
MD5

41a2f1caab50ebde2911ec0aa9e0dc30
SHA1

dce8b1773b2944d4e28d8c53c3224acd1e53c4cc
SHA256

33ff0db152d0f78636522a1825b9366d71fc1bbc667158e8a3019a5beec609ff
SHA512

d62ceef70c45124a4837523095dbd492be6b267ed01ee70a2e46518e713636b82fa94047da4a13a68aa6d8f46c8e8b0fe44527182216f3440f1d3442c39175d6

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.txt

Ransom Note

All of your files have been encrypted. Your backup files as well. We have exfiltrated tons of your private data to our servers as well. In order to restore your operations, and keep your business reputation intact, contact us directly on the below TOX ID. 1) TOX Download: https://tox.chat/ 2) TOX ID: 4A7F41CC6A5B87AF99450066F313C224D4E0E5501414670A8C5B802403E6292F859F178BB85F 3) Install TOX and add the TOX ID in the step 2 4) Share your personal ID over TOX chat We will not hesitate to make your data public , sell to your competitors , or send your clients their data. Talking to law enforcement will only ensure that you don't get a decryption key and put your business reputation on the line. Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. Your personal ID: 76899F60

URLs

https://tox.chat/

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\readme-warning.txt

Ransom Note

All of your files have been encrypted. Your backup files as well. We have exfiltrated tons of your private data to our servers as well. In order to restore your operations, and keep your business reputation intact, contact us directly on the below TOX ID. 1) TOX Download: https://tox.chat/ 2) TOX ID: 4A7F41CC6A5B87AF99450066F313C224D4E0E5501414670A8C5B802403E6292F859F178BB85F 3) Install TOX and add the TOX ID in the step 2 4) Share your personal ID over TOX chat We will not hesitate to make your data public , sell to your competitors , or send your clients their data. Talking to law enforcement will only ensure that you don't get a decryption key and put your business reputation on the line. Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam. Your personal ID: 0968C588

URLs

https://tox.chat/

Targets

- Target
  
  ransom.exe
- Size
  
  34KB
- MD5
  
  41a2f1caab50ebde2911ec0aa9e0dc30
- SHA1
  
  dce8b1773b2944d4e28d8c53c3224acd1e53c4cc
- SHA256
  
  33ff0db152d0f78636522a1825b9366d71fc1bbc667158e8a3019a5beec609ff
- SHA512
  
  d62ceef70c45124a4837523095dbd492be6b267ed01ee70a2e46518e713636b82fa94047da4a13a68aa6d8f46c8e8b0fe44527182216f3440f1d3442c39175d6
Score

10^/10

makop ransomware spyware stealer
- Makop
  Ransomware family discovered by @VK_Intel in early 2020.
  ransomware makop
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Modifies extensions of user files
  Ransomware generally changes the extension on encrypted files.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
behavioral1 behavioral2