makop

General

Target

e7aa0daa42cf46f9268775f5deff2b2f9574ef893202491521e89a7540688152
Size

549KB
Sample

211219-lkllvaghhq
MD5

0aef3aef127a4f780fc0166e4ed8ebac
SHA1

de5e59cd81f17027d811400bc7d48765e1d55df2
SHA256

e7aa0daa42cf46f9268775f5deff2b2f9574ef893202491521e89a7540688152
SHA512

1cd35a889aebf12b42b43eb83aa8c224e1896045c37b0f08f89b5910ff55e15bcba9e215f97ead7432dc47796263508906287e184ab9f6c602097f7eb93ce5fa

Score

10^/10

makop redline 10 discovery evasion infostealer ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Windows\Tasks\readme-warning.txt

Ransom Note

All of your files have been encrypted. Your backup files as well. We have exfiltrated tons of your private data to our servers including data of your clients, dont believe us ? Read on. In order to restore your operations, avoid leaking/selling your data, and keep your business reputation intact, contact us directly on the below TOX ID as soon as possible. 1) TOX Download: https://tox.chat/ 2) TOX ID: 5D935FD670BAEF3EA1938D60B91709D421DE8E21381267A77E16ED0D5FB4E36334304E35A472 3) Install TOX and add the TOX ID in the step 2 4) Share your personal ID over TOX chat (Do not send hello without your personal ID provided below) Upon contacting us, proof will be provided that we can decrypt your data, and samples of exfiltrated confidential information will also be provided. Although its not our intention , if you do not cooperate , we will not hesitate to make your data public including any confidential data , sell to your competitors/bidders , or send your clients their data just to make you look really bad and lose your clients trust , or even worse , being prosecuted for not telling your affected clients that their data has been compromised. Talking to law enforcement will only ensure that you don't get a decryption key and put your business reputation on the line. Attention! - Do not rename encrypted files. - Do not try to decrypt your data using third party software, it may cause permanent data loss. Your personal ID: 570E7D26

URLs

https://tox.chat/

Extracted

Family

redline

Botnet

10

C2

18.191.251.199:45097

Targets

- Target
  
  e7aa0daa42cf46f9268775f5deff2b2f9574ef893202491521e89a7540688152
- Size
  
  549KB
- MD5
  
  0aef3aef127a4f780fc0166e4ed8ebac
- SHA1
  
  de5e59cd81f17027d811400bc7d48765e1d55df2
- SHA256
  
  e7aa0daa42cf46f9268775f5deff2b2f9574ef893202491521e89a7540688152
- SHA512
  
  1cd35a889aebf12b42b43eb83aa8c224e1896045c37b0f08f89b5910ff55e15bcba9e215f97ead7432dc47796263508906287e184ab9f6c602097f7eb93ce5fa
Score

10^/10

makop redline 10 discovery evasion infostealer ransomware spyware stealer trojan
- MAKOP ransomware payload
- Makop
  Ransomware family discovered by @VK_Intel in early 2020.
  ransomware makop
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1