Extracted

Extracted

Extracted

Extracted

• • Target
    Maktub_Ransomware.exe
  • Size 247KB
  • SHA256 7887277540f971323a2c823526014136590fbffa3c5e4472de31e3e705459df4
  • MD5 e87136d20396db6da59342011a203111
  • SHA1 97c308207a9354ec869f56bd42267c56b48d6c4d
  • SHA512 073f00250bf0d603b82f4adb94881115addda48944761fa2e21a94554021b4f41e2174ac9276788ea20f7bde62ba06f0f56b05178141fdaf8d396c628e871c13
  • SSDEEP 3072:cYOvEC49nmy5fOajnI8gV6sPQkd61tb7iaOXiy8X500m+DZNXCJuSwCufvBufv4w:cYmEDmyEajnPu6sujX1SuSwR1
  • TLSH
    T1BF4439D0FE0CA274D602B172886A66CC59AA5CF1FF25CC7B653E71AEDD21BA04135273
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionimpactransomwareupxmaktub

  • Family: Maktub Locker

    Advanced ransomware family capable of offline decryption, generally distributed via .scr email attachments.

    ransomwaremaktub

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Renames multiple (326) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2