Behavioral task
behavioral1
Sample
2024-09-16_2116e2be48afbe7c65e89bd0cebaec8c_makop.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-16_2116e2be48afbe7c65e89bd0cebaec8c_makop.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-16_2116e2be48afbe7c65e89bd0cebaec8c_makop
-
Size
42KB
-
MD5
2116e2be48afbe7c65e89bd0cebaec8c
-
SHA1
3658f4fa9128a1f4e2a533083dfdb82f32ce8368
-
SHA256
3a311679a57eabb27cb3aa62ad10a98403ed1ad705f9c519372099ec715b21bb
-
SHA512
2f2520a6dcd39adc65fbe6fb112748b437d8aaeb26393ff0a710b47ccc3298c120d0430d43b0a80e8a3059ca8fc96ad5de740fbefd8048980edb74e85417fa4b
-
SSDEEP
768:rO1oR/wVS1RzK4wbs+D/SIJX+ZZ1SQQwZuIOPzDRCbpkxDFBZZTE9+z+:rcS1FKnDtkuImspCnZZTE9+a
Malware Config
Signatures
-
MAKOP ransomware payload 1 IoCs
resource yara_rule sample family_makop -
Makop family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-09-16_2116e2be48afbe7c65e89bd0cebaec8c_makop
Files
-
2024-09-16_2116e2be48afbe7c65e89bd0cebaec8c_makop.exe windows:4 windows x86 arch:x86
364f4eb85abb3fe033aa9cfae7ac6b24
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW
kernel32
ReadFile
CreateFileW
GetFileSizeEx
MoveFileW
SetFileAttributesW
HeapAlloc
GetCurrentProcess
HeapFree
GetProcessHeap
GetVersion
GetProcAddress
LoadLibraryA
GetCurrentProcessId
OpenProcess
SetFilePointerEx
GetModuleHandleA
DuplicateHandle
ExitProcess
GetEnvironmentVariableW
CreateProcessW
CreatePipe
LocalFree
GetCommandLineW
Process32NextW
CreateMutexA
CreateToolhelp32Snapshot
GetLocaleInfoW
GetModuleFileNameW
Process32FirstW
GetSystemWindowsDirectoryW
SetHandleInformation
GetTempPathW
GetTempFileNameW
CreateDirectoryW
WriteFile
Sleep
FindClose
GetLastError
GetFileAttributesW
GetLogicalDrives
WaitForSingleObject
CreateThread
GetVolumeInformationW
SetErrorMode
FindNextFileW
GetDriveTypeW
WaitForMultipleObjects
FindFirstFileW
TerminateProcess
DeleteCriticalSection
GetExitCodeProcess
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
CloseHandle
GetFileType
PeekNamedPipe
user32
wsprintfA
GetShellWindow
wsprintfW
GetWindowThreadProcessId
ReleaseDC
SystemParametersInfoW
DrawTextA
GetDC
gdi32
CreateFontW
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
DeleteObject
SetBkMode
DeleteDC
SetTextColor
GetObjectW
GetDeviceCaps
GetDIBits
advapi32
CryptGenRandom
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
DuplicateTokenEx
OpenProcessToken
SetTokenInformation
GetTokenInformation
CryptDecrypt
CryptDestroyKey
CryptAcquireContextW
CryptSetKeyParam
CryptReleaseContext
CryptImportKey
CryptEncrypt
shell32
ord680
CommandLineToArgvW
SHGetSpecialFolderPathW
msimg32
GradientFill
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE