Extracted

• • Target

    200730-48mxz512fa_pw_infected.zip

  • Size

    1.1MB

  • MD5

    69a28e00bba77e3551479aa226aa4237

  • SHA1

    37ffc2bc63a0a82963ce7720696266e6acce95ba

  • SHA256

    e642de5564a66dba2c2da9bd657d79153b6e65c2c1ad55f8da5be0d471bac242

  • SHA512

    b6906281d19579e8941287ae7315f0516b454681cab122faac594f74c2766109a64cab764aefbbc040213b217d5dd8f72585367fb533077896ecba34d09fa8c7

  • SSDEEP

    24576:gUgNEpGTKCB5Muwytp3FGtYpSZ0HPRgN8zhXHV+VLLGiNMN3:UNEpGFB1wERFGtySZY+EhX1+VnNMV

  Score

  10^/10

  makopdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop

  • Makop family

    makop

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (8302) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2

• • Target

    mkp.exe

  • Size

    1.2MB

  • MD5

    2055bbde7b5a1afd6ea79974d1435a98

  • SHA1

    e249c4f1d0910cb4660a3d41593692a02796472f

  • SHA256

    e51abdb2023b560244802f7d9687944dc0dff3042c28d7bc7a2b517df6e24942

  • SHA512

    f21f963ea6f3c394f61780825a0971f432450a7ca94353db0ba5915a0e190f0d65025c40756597b0170a3c23fb160e27011ce4a098afe2a518efc47a06874d55

  • SSDEEP

    24576:AQkBF2DuFBsfrCbHdtvIwTGp+olFTPPxQoZeKVbygpgPh3aFMI9R2uacQs:AQIBsfrCHdtvdTCTO2pdygpiAJads

  Score

  10^/10

  makopdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealercredential_access

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop

  • Makop family

    makop

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (8333) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral3behavioral4