makop | 91cec9ea80134308f3698d8b749efe127274123a9bd706a1b9a29597e5d2e31f

General

Target
2026-03-13_ca1e36474f09f4eed7e1cee18d682da8_cobalt-strike_elex_makop_njrat
Size 119KB
Sample260313-pr9tssbw7q
SHA256 91cec9ea80134308f3698d8b749efe127274123a9bd706a1b9a29597e5d2e31f
MD5 ca1e36474f09f4eed7e1cee18d682da8
SHA1 f6ae306880a70794190351b68460d9f22f4accc8
SHA512 e63084ba161e390b70ab6419ea38ff34a0dafa80981b323d824afb8a038eaa751ffc09b93803c8c8a7afd9e4c0a3f2c49c832fd70042508bc384289904c2f8a3
SSDEEP 3072:C/318RZEvsbyOgMjdoC86K4w3mkRqer5+nclob:u318RHyObdSZMSqer5+nH
TLSH
T16FC37C1E7B69B8F3DA304E34686496969373AC43AB5017D36CD4930D8C632F85E7BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\Common Files\microsoft shared\ClickToRun\+README-WARNING+.txt

Ransom Note

::: Hey ::: Small FAQ: .1. Q: What's going on? A: Your files have been encrypted. The file structure was not affected, we did our best to prevent this from happening. .2. Q: How to recover files? A: If you want to decrypt your files, you will need to pay us. .3. Q: What about guarantees? A: It's just business. We are absolutely not interested in you and your transactions, except for profit. If we do not fulfill our work and obligations, no one will cooperate with us. It's not in our interest. To check the possibility of returning files, you can send us any 2 files with SIMPLE extensions (jpg, xls, doc, etc... not databases!) and small sizes (max 1 mb), we will decrypt them and send them back to you. This is our guarantee. .4. Q: How to contact you? A: You can write to us at our mailboxes: [email protected] .5. Q: How will the decryption process take place after payment? A: After payment, we will send you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don't want to pay bad people like you? A: If you do not cooperate with our service - it does not matter to us. But you will lose your time and data because only we have the private key. In practice, time is much more valuable than money. :::BEWARE::: DO NOT try to modify encrypted files yourself! If you try to use third party software to recover your data or antivirus solutions - back up all encrypted files! Any changes to the encrypted files may result in damage to the private key and, as a result, the loss of all data. Note: ::::::IF WE HAVE NOT RESPONSE YOU BY MAIL WITHIN 24 HOURS:::::: Spare contact for communication: If we have not answered your email within 24 hours, you can contact us via the free messenger qTox Download from the link https://tox.chat/download.html Next go qTox 64-bit after downloading the program, install it and go through a short registration. Our Tox ID 37CDA60B5B593473E120366CCF68A8C08F503880D2AE7F0F4161C2C9C0502C6304DDA2B19D8E

Emails

[email protected]

URLs

https://tox.chat/download.html

Targets

- Target
  2026-03-13_ca1e36474f09f4eed7e1cee18d682da8_cobalt-strike_elex_makop_njrat
- Size 119KB
- SHA256 91cec9ea80134308f3698d8b749efe127274123a9bd706a1b9a29597e5d2e31f
- MD5 ca1e36474f09f4eed7e1cee18d682da8
- SHA1 f6ae306880a70794190351b68460d9f22f4accc8
- SHA512 e63084ba161e390b70ab6419ea38ff34a0dafa80981b323d824afb8a038eaa751ffc09b93803c8c8a7afd9e4c0a3f2c49c832fd70042508bc384289904c2f8a3
- SSDEEP 3072:C/318RZEvsbyOgMjdoC86K4w3mkRqer5+nclob:u318RHyObdSZMSqer5+nH
- TLSH
  T16FC37C1E7B69B8F3DA304E34686496969373AC43AB5017D36CD4930D8C632F85E7BB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution impact persistence ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (3362) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Drops file in System32 directory
behavioral1 behavioral2