Behavioral task
behavioral1
Sample
2025-03-14_7d4ac74129b6b97caa5906ac68afcf34_makop.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2025-03-14_7d4ac74129b6b97caa5906ac68afcf34_makop.exe
Resource
win10v2004-20250217-en
General
-
Target
2025-03-14_7d4ac74129b6b97caa5906ac68afcf34_makop
-
Size
34KB
-
MD5
7d4ac74129b6b97caa5906ac68afcf34
-
SHA1
c8620068897281d16694133e3fdb0392624dff85
-
SHA256
257ebc7ed3762db257e623992b492ec32fecab362f9ef81e1143afcea7c31581
-
SHA512
67aa4bb106a2e4932783dd96bfb7e93bc3af88a9c310663a7b0ed8abb469108b87fb3e23addfb38672cc05dd3d4a1014c6f83098bb26265df87ced9a6fb5cf70
-
SSDEEP
768:h4HLd8VdhiqV1Esg8kdJCzSIZHkKRV6kNDzqmaG8ZCg:hQ8VdV1U8ZGURVFl8n
Malware Config
Signatures
-
MAKOP ransomware payload 1 IoCs
resource yara_rule sample family_makop -
Makop family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-03-14_7d4ac74129b6b97caa5906ac68afcf34_makop
Files
-
2025-03-14_7d4ac74129b6b97caa5906ac68afcf34_makop.exe windows:4 windows x86 arch:x86
b2a2e59916055b004c7a8f339a45d95f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mpr
WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum
kernel32
FindFirstFileW
DeviceIoControl
GetDriveTypeW
WaitForMultipleObjects
SetErrorMode
FindNextFileW
Sleep
WriteFile
ReadFile
FlushFileBuffers
GetFileSizeEx
MoveFileW
SetFileAttributesW
SetEndOfFile
SetFilePointerEx
GetProcessHeap
GetVersion
FindClose
GetCurrentProcess
HeapFree
GetProcAddress
LoadLibraryA
OpenProcess
GetFileType
GetModuleHandleA
DuplicateHandle
GetCurrentProcessId
ExitProcess
GetLastError
GetCommandLineW
Process32NextW
CreateMutexA
CreateToolhelp32Snapshot
GetLocaleInfoW
GetEnvironmentVariableW
GetModuleFileNameW
PeekNamedPipe
CreateProcessW
Process32FirstW
GetSystemWindowsDirectoryW
SetHandleInformation
CreateDirectoryW
CreateFileW
GetFileAttributesW
GetLogicalDrives
CreateThread
WaitForSingleObject
GetVolumeInformationW
TerminateProcess
DeleteCriticalSection
GetExitCodeProcess
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
CloseHandle
HeapAlloc
CreatePipe
user32
wsprintfW
wsprintfA
GetShellWindow
GetWindowThreadProcessId
advapi32
CryptSetKeyParam
CryptAcquireContextW
CryptDecrypt
CryptDestroyKey
CryptGenRandom
CryptReleaseContext
GetTokenInformation
SetTokenInformation
OpenProcessToken
RegCloseKey
DuplicateTokenEx
RegQueryValueExA
RegOpenKeyExA
CryptEncrypt
CryptImportKey
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
ord680
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE