Behavioral task
behavioral1
Sample
2025-03-04_b032ecd86b56a0073d46319c04c22387_makop_ramnit.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral2
Sample
2025-03-04_b032ecd86b56a0073d46319c04c22387_makop_ramnit.exe
Resource
win10ltsc2021-20250218-en
General
-
Target
2025-03-04_b032ecd86b56a0073d46319c04c22387_makop_ramnit
-
Size
300KB
-
MD5
b032ecd86b56a0073d46319c04c22387
-
SHA1
7dc793419d208948c9dec4e98b5613d92c11464c
-
SHA256
923686c8d1c000dc4a3422918517528a42bbb9a342ccd99ce996f26f55611560
-
SHA512
534a4585dcaffc7bae5708cf4a5406544339d29a06621ef2797035a00bd2ce6d9de47ea33da43402028aaaf084859ae607b7efaf692db160ad192b239511e7ae
-
SSDEEP
3072:iQQhGI14gbuREdfLgAwV4OgSzBmh04eZFkz3Rr0gwGj9Tf81:iEI14YZLXMzzILGFkzhr0pGj9o1
Malware Config
Signatures
-
MAKOP ransomware payload 1 IoCs
resource yara_rule sample family_makop -
Makop family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-04_b032ecd86b56a0073d46319c04c22387_makop_ramnit
Files
-
2025-03-04_b032ecd86b56a0073d46319c04c22387_makop_ramnit.exe windows:4 windows x86 arch:x86
2032a534c15925dbc70f6359f55b66ce
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
FreeLibrary
OpenMutexA
CloseHandle
CreateFileA
WriteFile
GetModuleFileNameA
CreateProcessA
GetWindowsDirectoryA
GetVolumeInformationA
DeviceIoControl
WaitForMultipleObjects
FindNextFileW
GetVolumeInformationW
CreateThread
Sleep
WriteFile
SetEndOfFile
SetFilePointerEx
ReadFile
GetFileSizeEx
MoveFileW
SetFileAttributesW
HeapAlloc
GetCurrentProcess
HeapFree
GetProcessHeap
FindClose
OpenProcess
GetProcAddress
GetFileType
GetModuleHandleA
DuplicateHandle
GetCurrentProcessId
ExitProcess
GetCommandLineW
CreatePipe
GetLastError
CreateProcessW
GetSystemWindowsDirectoryW
SetHandleInformation
GetLocaleInfoW
GetModuleFileNameW
Process32FirstW
Process32NextW
CreateMutexA
CreateToolhelp32Snapshot
GetVersion
CreateDirectoryW
GetFileAttributesW
CreateFileW
GetLogicalDrives
WaitForSingleObject
SetErrorMode
GetDriveTypeW
FindFirstFileW
CloseHandle
DeleteCriticalSection
EnterCriticalSection
TerminateProcess
GetExitCodeProcess
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
advapi32
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptAcquireContextW
CryptDecrypt
OpenProcessToken
GetTokenInformation
SetTokenInformation
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
DuplicateTokenEx
RegQueryValueExA
RegOpenKeyExA
CryptReleaseContext
CryptSetKeyParam
mpr
WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum
shell32
ord680
CommandLineToArgvW
ShellExecuteExW
SHGetSpecialFolderPathW
user32
wsprintfW
GetShellWindow
GetWindowThreadProcessId
wsprintfA
Sections
UPX0 Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE