makop | 1418f96bb8de8270e496c2676c5c567ceba03d195f198770352107c73c19fb01

General

Target

2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop
Size

42KB
Sample

250411-r9fd1ssve1
MD5

bea663ba7b6ed934d7e41950010d6c22
SHA1

e01fc5f2dd09784e194fe336334c5b54b76fadbc
SHA256

1418f96bb8de8270e496c2676c5c567ceba03d195f198770352107c73c19fb01
SHA512

b9a5093a1b1078e51176ef31bf88034f0fa0be5f3a97dcb3c59b64e8939b15498adc0f228c68ba084fc6506eabe4c16491e7dacd177ef502909b5f08a61df8b6
SSDEEP

768:ono/YW1wUFGKQI1LSi/TqBKjBg1PuCu7bxGW60596iwL1gw6+fTmIHZDS6/0gTHd:onzW1w1TI1rTEKjBgU9h596I+fTDBSz1

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\scoped_dir4876_957996442\CRX_INSTALL\_locales\am\readme-warning.txt

Ransom Note

Hello my dear friend Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted If you want to restore them, install ICQ software on your PC https://icq.com/windows/ or on your mobile phone search in Appstore / Google market ICQ Write to our ICQ @Lookfornewitguy https://icq.im/Lookfornewitguy Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. As early you write us - then lower will be price We give all guarantees of your files decryption

URLs

https://icq.com/windows/

https://icq.im/Lookfornewitguy

Targets

- Target
  
  2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop
- Size
  
  42KB
- MD5
  
  bea663ba7b6ed934d7e41950010d6c22
- SHA1
  
  e01fc5f2dd09784e194fe336334c5b54b76fadbc
- SHA256
  
  1418f96bb8de8270e496c2676c5c567ceba03d195f198770352107c73c19fb01
- SHA512
  
  b9a5093a1b1078e51176ef31bf88034f0fa0be5f3a97dcb3c59b64e8939b15498adc0f228c68ba084fc6506eabe4c16491e7dacd177ef502909b5f08a61df8b6
- SSDEEP
  
  768:ono/YW1wUFGKQI1LSi/TqBKjBg1PuCu7bxGW60596iwL1gw6+fTmIHZDS6/0gTHd:onzW1w1TI1rTEKjBgU9h596I+fTDBSz1
Score

10^/10

credential_access defense_evasion discovery execution impact ransomware spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (9365) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
behavioral1