makop | a58ede562da836a738916bfe78558cd8f30064d74ec4e4490daf821ebc1c1d8b

General

Target
2026-07-28_9bb1db444fac46dc0fe77532709a699d_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
Size 159KB
Sample260729-a15twasvev
SHA256 a58ede562da836a738916bfe78558cd8f30064d74ec4e4490daf821ebc1c1d8b
MD5 9bb1db444fac46dc0fe77532709a699d
SHA1 67afc7e719ff361eb4017ee7504fcae09044ee4a
SHA512 77f9ff99d3394d504d72dcbc2a388a3c164b581e7673aa7c3a48801e540a076d90801906191d4963677e846d9ce2a850fccb4a368d3c17ece6493339851ad7bd
SSDEEP 3072:VZwljuR8qwZ6wo067Jg9/eAfMhtMujM61o26X:VZwljH6wjreUMhefT26
TLSH
T1B5F39F42B3C48075E8A61534B439EAB2157B7CB7B674968F2798392B2F732E20574F07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-28_9bb1db444fac46dc0fe77532709a699d_amadey_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_tofsee
- Size 159KB
- SHA256 a58ede562da836a738916bfe78558cd8f30064d74ec4e4490daf821ebc1c1d8b
- MD5 9bb1db444fac46dc0fe77532709a699d
- SHA1 67afc7e719ff361eb4017ee7504fcae09044ee4a
- SHA512 77f9ff99d3394d504d72dcbc2a388a3c164b581e7673aa7c3a48801e540a076d90801906191d4963677e846d9ce2a850fccb4a368d3c17ece6493339851ad7bd
- SSDEEP 3072:VZwljuR8qwZ6wo067Jg9/eAfMhtMujM61o26X:VZwljH6wjreUMhefT26
- TLSH
  T1B5F39F42B3C48075E8A61534B439EAB2157B7CB7B674968F2798392B2F732E20574F07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution makop impact persistence ransomware spyware stealer
- Family: Makop
  Ransomware family discovered by @VK_Intel in early 2020.
  ransomware makop
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (9820) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2