Extracted

• • Target

    2025-03-14_7d4ac74129b6b97caa5906ac68afcf34_makop

  • Size

    34KB

  • MD5

    7d4ac74129b6b97caa5906ac68afcf34

  • SHA1

    c8620068897281d16694133e3fdb0392624dff85

  • SHA256

    257ebc7ed3762db257e623992b492ec32fecab362f9ef81e1143afcea7c31581

  • SHA512

    67aa4bb106a2e4932783dd96bfb7e93bc3af88a9c310663a7b0ed8abb469108b87fb3e23addfb38672cc05dd3d4a1014c6f83098bb26265df87ced9a6fb5cf70

  • SSDEEP

    768:h4HLd8VdhiqV1Esg8kdJCzSIZHkKRV6kNDzqmaG8ZCg:hQ8VdV1U8ZGURVFl8n

  Score

  10^/10

  makopdefense_evasiondiscoveryexecutionimpactransomwarespywarestealercredential_accesspersistence

  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop

  • Makop family

    makop

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (8236) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes backup catalog

    Uses wbadmin.exe to inhibit system recovery.

    ransomware

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2