makop | dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309

General

Target
dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309
Size 396KB
Sample221228-sajstsdg21
SHA256 dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309
MD5 6a956731b3677dd9d4d18641d40532ab
SHA1 1994ee0b381c5528d5b5c01fb97a14b5ff81e5a5
SHA512 314d87605dfe01cfb83a8b6ff17e98fc933f012ef933557d1899ebf0941d892a37f0d0692d99a3cd7061ce6c2c90a6dafe7b8dbb80ae875d9c368529f0b87991
SSDEEP 1536:n28VgV1U8ZGURVFB3eH/omAhUfKQnSz+jS7ddpjHXSeSv3caALL95T:28VgV1UqGgVFBKo8ybdz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

makop

Malware Config

Signatures

MAKOP ransomware payload 1 IoCs

resource	yara_rule
sample	family_makop

Makop family
makop

File Explorer

dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309

.exe 396KB

dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309

IMPHASH b2a2e59916055b004c7a8f339a45d95f
SHA256 dc4bb89a5e91280cb1fcf1d87f8616fe3cc283159c8babb240b437d2e1e5a309
MD5 6a956731b3677dd9d4d18641d40532ab
SHA1 1994ee0b381c5528d5b5c01fb97a14b5ff81e5a5
SHA512 314d87605dfe01cfb83a8b6ff17e98fc933f012ef933557d1899ebf0941d892a37f0d0692d99a3cd7061ce6c2c90a6dafe7b8dbb80ae875d9c368529f0b87991
SSDEEP 1536:n28VgV1U8ZGURVFB3eH/omAhUfKQnSz+jS7ddpjHXSeSv3caALL95T:28VgV1UqGgVFBKo8ybdz
MD5 SHA1 SHA512 SSDEEP

windows x86

MAKOP ransomware payload

Minor OS version

Major OS version

Entry point

21488

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetEnumResourceW WNetOpenEnumW WNetCloseEnum

kernel32

FindFirstFileW DeviceIoControl GetDriveTypeW WaitForMultipleObjects SetErrorMode FindNextFileW Sleep WriteFile ReadFile FlushFileBuffers GetFileSizeEx MoveFileW SetFileAttributesW SetEndOfFile SetFilePointerEx GetProcessHeap GetVersion FindClose GetCurrentProcess HeapFree GetProcAddress LoadLibraryA OpenProcess GetFileType GetModuleHandleA DuplicateHandle GetCurrentProcessId ExitProcess GetLastError GetCommandLineW Process32NextW CreateMutexA CreateToolhelp32Snapshot GetLocaleInfoW GetEnvironmentVariableW GetModuleFileNameW PeekNamedPipe CreateProcessW Process32FirstW GetSystemWindowsDirectoryW SetHandleInformation CreateDirectoryW CreateFileW GetFileAttributesW GetLogicalDrives CreateThread WaitForSingleObject GetVolumeInformationW TerminateProcess DeleteCriticalSection GetExitCodeProcess LeaveCriticalSection InitializeCriticalSection EnterCriticalSection CloseHandle HeapAlloc CreatePipe

user32

wsprintfW wsprintfA GetShellWindow GetWindowThreadProcessId

advapi32

CryptSetKeyParam CryptAcquireContextW CryptDecrypt CryptDestroyKey CryptGenRandom CryptReleaseContext GetTokenInformation SetTokenInformation OpenProcessToken RegCloseKey DuplicateTokenEx RegQueryValueExA RegOpenKeyExA CryptEncrypt CryptImportKey

shell32

SHGetSpecialFolderPathW CommandLineToArgvW ord680

Sharing