Extracted

• • Target

    2025-02-01_956d4875855427a4eab2929413b397eb_makop_neshta

  • Size

    89KB

  • MD5

    956d4875855427a4eab2929413b397eb

  • SHA1

    f1b139d31050e53aef22d3cdee0a98c510165d99

  • SHA256

    72b86cb783b57ef3a62fcce38ff308fdd303f38f73e8283356f5140e8607e2ea

  • SHA512

    61a3fdeee055319b6c9c25c0f136cc4b07844d61c079f3cca23d79344f3add6d5edc397f95de8a61ca16f9fd45f4a05df997ae542a6ef4cdba27307966e763f3

  • SSDEEP

    1536:JxqjQ+P04wsmJCPbInVXEedxaX318HxZATvnsblYO6CaPK7s:sr85CPIlHa318RZEvsbyOZaPus

  Score

  10^/10

  makopneshtadefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

  • Detect Neshta payload

  • MAKOP ransomware payload

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop

  • Makop family

    makop

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Neshta family

    neshta

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (8316) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2