Extracted

• • Target

    202410017a0ec0db72b084f46348b055c7ce4a34makopneshta

  • Size

    89KB

  • MD5

    7a0ec0db72b084f46348b055c7ce4a34

  • SHA1

    d2f9f41e5826f34e680e56dc0162bd219cf59098

  • SHA256

    e48904c3a631f353f6bf1cd3c2509464c86454db1d29bff26b489ffa563788d9

  • SHA512

    3c06796f43a38b5151e701594f38a95b5525670ece504715d0a85c29d61814813b67c3533a926ef551f76e3b5e49424327bdb9647f359c73dafadda7e992c127

  • SSDEEP

    1536:JxqjQ+P04wsmJCrb/eEExaD318HxZATvnsblYOIDQbj:sr85Crb/eECa318RZEvsbyOoQH

  Score

  10^/10

  makopneshtadefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

  • Detect Neshta payload

  • MAKOP ransomware payload

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (8306) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2