General
-
Target
2024-04-04_e3df968710e745180b19deec7b7d29b3_makop
-
Size
42KB
-
Sample
240404-ykaksshc84
-
MD5
e3df968710e745180b19deec7b7d29b3
-
SHA1
09f9fcee4d6c976226a489cc6f8592547ecb55a1
-
SHA256
549f3746e39af9678f011fa3f23be8e238e9802696d5e7da6a40b1b7eb2f8346
-
SHA512
0fb570d324a9ff86a63a3529cf25942adad66b82de1fbff6c2ae675227e258e441b2aeea7e63132a87ddb5e40eecf66e70092824184f36568f29ab90027067f6
-
SSDEEP
768:Nu1oK+uVi1RzarwLc+D/CIJX+ZpFywgZuIOPzDLet1gutzPBY:NCi1FaQD9duImKtNtjW
Behavioral task
behavioral1
Sample
2024-04-04_e3df968710e745180b19deec7b7d29b3_makop.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-04_e3df968710e745180b19deec7b7d29b3_makop.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\+README-WARNING+.txt
https://qtox.github.io/
Targets
-
-
Target
2024-04-04_e3df968710e745180b19deec7b7d29b3_makop
-
Size
42KB
-
MD5
e3df968710e745180b19deec7b7d29b3
-
SHA1
09f9fcee4d6c976226a489cc6f8592547ecb55a1
-
SHA256
549f3746e39af9678f011fa3f23be8e238e9802696d5e7da6a40b1b7eb2f8346
-
SHA512
0fb570d324a9ff86a63a3529cf25942adad66b82de1fbff6c2ae675227e258e441b2aeea7e63132a87ddb5e40eecf66e70092824184f36568f29ab90027067f6
-
SSDEEP
768:Nu1oK+uVi1RzarwLc+D/CIJX+ZpFywgZuIOPzDLet1gutzPBY:NCi1FaQD9duImKtNtjW
Score10/10-
Renames multiple (2777) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in System32 directory
-