Extracted

• • Target

    2024-10-05_d95283d331eded844f64dde393e81d2f_makop_neshta

  • Size

    89KB

  • MD5

    d95283d331eded844f64dde393e81d2f

  • SHA1

    ad81f47a20a9681828e14dbb5ec99323a16a7cdc

  • SHA256

    c5c28f06fc605a7b68c52713f035f7546a15f0ca19761f96903a55021d62c733

  • SHA512

    ce3de62852a6d8595e77db647cfcc5f5ec03317c1f6f44c4b468b1419f37edff8b4f201ba2f17ab223ae2a19c5fcfe73cfb3c105fa0c9fe371ff3abe050235cc

  • SSDEEP

    1536:JxqjQ+P04wsmJCEsmYRFixay318HxZATvnsblYO8Mk:sr85CEsm0e/318RZEvsbyOs

  Score

  10^/10

  makopneshtadefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

  • Detect Neshta payload

  • MAKOP ransomware payload

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (8314) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2