makop | 4aace7fd7ba4c0eb24454f9bbf161499363ff34fc5c2eb81b982a25cfc0fdd27

General

Target

2024-10-07_048b493c1e9795a8d28a511d88b86f9e_makop
Size

49KB
Sample

241007-g48s9svale
MD5

048b493c1e9795a8d28a511d88b86f9e
SHA1

d4ab7061b3de8a4ca9875e343ed04f128f1d6bff
SHA256

4aace7fd7ba4c0eb24454f9bbf161499363ff34fc5c2eb81b982a25cfc0fdd27
SHA512

d340f31d9dc148cc6127643c43b95360372f073cbc3b469307df54977c403ac13b42ad95b1035299a51cb296eef711d4ebd278a4348d394aac5ad52b65afb99a
SSDEEP

768:uaQRffTB31aCytHLykiKPT3JATD2qBwV2ckjbnsb0Ah99De0YADI3w9L86s7D7dG:uaK318HxZATvnsblYOIR6s7DM

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\+README-WARNING+.txt

Ransom Note

::: Greetings ::: DO NOT TRY TO CONTACT MIDDLEMAN OR ANY INTERMEDIARI THEY DONT HAVE THE ABBILITY TO RETURN YOUR FILES AND MOST LIKELY YOU WILL GET SCAMMED OR THEY WILL CHARGE THEIR FEE AND OUR FEE SO THINK THIS AS DOUBLE PRICE! ONLY US HAVE THE ABBILITY TO GET YOUR FILES BACK Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay us in Bitcoin or any other cryptocurrency of our choice. .3. Q: What about guarantees? A: This is just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailboxes: [email protected] In case not answer in 24 hours: [email protected] Our telegram: https://t.me/decsupport24 .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don’t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Emails

[email protected]

URLs

https://t.me/decsupport24

Targets

- Target
  
  2024-10-07_048b493c1e9795a8d28a511d88b86f9e_makop
- Size
  
  49KB
- MD5
  
  048b493c1e9795a8d28a511d88b86f9e
- SHA1
  
  d4ab7061b3de8a4ca9875e343ed04f128f1d6bff
- SHA256
  
  4aace7fd7ba4c0eb24454f9bbf161499363ff34fc5c2eb81b982a25cfc0fdd27
- SHA512
  
  d340f31d9dc148cc6127643c43b95360372f073cbc3b469307df54977c403ac13b42ad95b1035299a51cb296eef711d4ebd278a4348d394aac5ad52b65afb99a
- SSDEEP
  
  768:uaQRffTB31aCytHLykiKPT3JATD2qBwV2ckjbnsb0Ah99De0YADI3w9L86s7D7dG:uaK318HxZATvnsblYOIR6s7DM
Score

10^/10

defense_evasion discovery execution impact ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (8352) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2