makop | bd935610cb878e275d35f292b93d8459[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

bd935610cb878e275d35f292b93d8459.bin
Size

21KB
MD5

93861858e17c24f1f036473b405ae31f
SHA1

506a393f2b778b2515025879cde5253ca377a3eb
SHA256

45c966f20bdd9507b2790b8b85176b113e81f5164b663d2f7ad07dbaa6da7eea
SHA512

0f4c280d8dde3820ef80d77f79a412aca757e263f95273634c7c71444407e4f4527d0ee7f7db7211ab5764e44f95945ebbeb80f315f4715fcd247e87aaa109dc
SSDEEP

384:nqOp2NjfNCqe0a+5/Z3PVwCNZUUIVf+EHWh/xhSF3NvP03/6v22Zzl6bo:Zp4NCua+5xfwf1GSP03/V2Z56s

Score

10^/10

makop

Malware Config

Signatures

MAKOP ransomware payload 1 IoCs

resource	yara_rule
static1/unpack001/3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe	family_makop

Makop family
makop

Files

bd935610cb878e275d35f292b93d8459.bin
.zip

Password: infected
3757824893405fd34313749b689879b40b02db3d8a682f9f88e23f63908881f7.exe
.exe windows x86

Password: infected

5988200545f6843158ab4449775607e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum

kernel32

DeviceIoControl
WaitForMultipleObjects
FindNextFileW
GetVolumeInformationW
CreateThread
Sleep
WriteFile
SetEndOfFile
SetFilePointerEx
ReadFile
GetFileSizeEx
MoveFileW
SetFileAttributesW
HeapAlloc
GetCurrentProcess
HeapFree
GetProcessHeap
FindClose
GetVersion
GetProcAddress
LoadLibraryA
OpenProcess
GetFileType
GetModuleHandleA
DuplicateHandle
GetCurrentProcessId
ExitProcess
GetCommandLineW
GetLastError
GetEnvironmentVariableW
PeekNamedPipe
CreateProcessW
GetSystemWindowsDirectoryW
SetHandleInformation
GetLocaleInfoW
GetModuleFileNameW
Process32FirstW
Process32NextW
CreateMutexA
CreateToolhelp32Snapshot
CreateDirectoryW
CreateFileW
GetLogicalDrives
WaitForSingleObject
SetErrorMode
GetDriveTypeW
FindFirstFileW
CloseHandle
DeleteCriticalSection
EnterCriticalSection
TerminateProcess
GetExitCodeProcess
LeaveCriticalSection
InitializeCriticalSection
CreatePipe

user32

wsprintfW
wsprintfA
GetShellWindow
GetWindowThreadProcessId

advapi32

CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptAcquireContextW
CryptDecrypt
OpenProcessToken
GetTokenInformation
SetTokenInformation
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
DuplicateTokenEx
RegQueryValueExA
RegOpenKeyExA
CryptReleaseContext
CryptSetKeyParam

shell32

ord680
CommandLineToArgvW
SHGetSpecialFolderPathW

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

5988200545f6843158ab4449775607e9

Headers

DLL Characteristics

File Characteristics

Imports

mpr

kernel32

user32

advapi32

shell32

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: - Virtual size: 70KB

.ndata Size: 6KB - Virtual size: 6KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 70KB

.ndata
Size: 6KB - Virtual size: 6KB