Behavioral task
behavioral1
Sample
ee8a4eac249c41bcb5178fafc6be756adb33e78f053773a70c9b51f56cdd714e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ee8a4eac249c41bcb5178fafc6be756adb33e78f053773a70c9b51f56cdd714e.exe
Resource
win10v2004-20240412-en
General
-
Target
0578114019302fe42056583b50aeba54f3c4e2ebb51e28cb0773f6afe7d1bff6
-
Size
25KB
-
MD5
ac53aea6dde4c7eadf5de05cfa0ac9cf
-
SHA1
61f1b9fa0d1d7282f16e0b4f06a4810378c1b287
-
SHA256
0578114019302fe42056583b50aeba54f3c4e2ebb51e28cb0773f6afe7d1bff6
-
SHA512
2ae17286a9be76b9d5c0545921924cc80df716416b620a4067e75c50e3f11b6fc91219c9d72428eb0b92c72bfee24adac558c7e0f4eea2aa2083ad99a105e2cb
-
SSDEEP
768:fSNTaYCYT4wZ0WfliECUnnRx9YPdzYsK87UxIx6:aRT4uPiXan9Y1szIk
Malware Config
Signatures
-
MAKOP ransomware payload 1 IoCs
resource yara_rule static1/unpack001/ee8a4eac249c41bcb5178fafc6be756adb33e78f053773a70c9b51f56cdd714e family_makop -
Makop family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ee8a4eac249c41bcb5178fafc6be756adb33e78f053773a70c9b51f56cdd714e
Files
-
0578114019302fe42056583b50aeba54f3c4e2ebb51e28cb0773f6afe7d1bff6.zip
Password: infected
-
ee8a4eac249c41bcb5178fafc6be756adb33e78f053773a70c9b51f56cdd714e.exe windows:4 windows x86 arch:x86
71964c01f21c7bdcdd5be87bbfa4df10
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum
kernel32
CreateFileW
GetLastError
FindClose
FindFirstFileW
DeviceIoControl
GetDriveTypeW
WaitForMultipleObjects
SetErrorMode
FindNextFileW
TryEnterCriticalSection
Sleep
GetStdHandle
WriteFile
ReadFile
FlushFileBuffers
GetFileSizeEx
MoveFileW
SetFileAttributesW
SetEndOfFile
SetFilePointerEx
GetProcessHeap
GlobalAlloc
GlobalFree
GetVersion
GetFileAttributesW
GetCurrentProcess
HeapFree
PeekNamedPipe
GetProcAddress
LoadLibraryA
GetComputerNameW
SetEvent
CreateEventW
TerminateThread
OpenProcess
GetFileType
GetModuleHandleA
DuplicateHandle
GetCurrentProcessId
ExitProcess
GetModuleHandleW
CreatePipe
GetCommandLineW
CreateToolhelp32Snapshot
GetSystemWindowsDirectoryW
GetLogicalDrives
GetLocaleInfoW
GetModuleFileNameW
GetEnvironmentVariableW
Process32FirstW
CreateProcessW
Process32NextW
CreateDirectoryW
CreateThread
WaitForSingleObject
GetVolumeInformationW
TerminateProcess
DeleteCriticalSection
GetExitCodeProcess
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
CloseHandle
HeapAlloc
SetHandleInformation
user32
DialogBoxParamW
KillTimer
ShowWindow
wsprintfA
MessageBoxW
SetWindowTextA
SendMessageW
GetWindowThreadProcessId
UnregisterHotKey
OpenClipboard
SetClipboardData
GetWindowTextLengthW
CloseClipboard
GetWindowTextA
EmptyClipboard
GetDlgItem
wsprintfW
GetShellWindow
SetTimer
SetWindowTextW
RegisterHotKey
EndDialog
EnableWindow
PostMessageW
advapi32
CryptGenRandom
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptSetKeyParam
CryptReleaseContext
GetTokenInformation
SetTokenInformation
OpenProcessToken
DuplicateTokenEx
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CryptDecrypt
CryptAcquireContextW
shell32
SHGetSpecialFolderPathW
ShellExecuteExW
CommandLineToArgvW
SHBrowseForFolderW
SHGetPathFromIDListW
ord680
ole32
CoUninitialize
CoTaskMemFree
CoInitialize
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 664B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ