makop | 6dd6a46854acba57841c564048ce280e3f296fe92ee7a37f628d891b666d0d8a

General

Target
2026-09-24_62a2c37ee9f24720e80dfb10f47a741f_elex_makop
Size 49KB
Sample260925-kgvvnscc93
SHA256 6dd6a46854acba57841c564048ce280e3f296fe92ee7a37f628d891b666d0d8a
MD5 62a2c37ee9f24720e80dfb10f47a741f
SHA1 27aae080bb5b8dfdf61b990df0162c5678efc3be
SHA512 3f740aadb2ff1764be53b584cf272ff4f5e5517815fa5afb3c8aabfde23830547e8da62b4151969b00109092ba0cf6de828f249704db01b3ac8e2ccdd8d5f47b
SSDEEP 1536:9ND183dAalnudHyFj6cBSfdYOdMyj5r2h:zD18endsOcBSfaOdMK5r2h
TLSH
T1E2339E1AE65E0AF3ED6429B418EBB713A85E580C032487D79F39AC8166D01D82CFD5F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-24_62a2c37ee9f24720e80dfb10f47a741f_elex_makop
- Size 49KB
- SHA256 6dd6a46854acba57841c564048ce280e3f296fe92ee7a37f628d891b666d0d8a
- MD5 62a2c37ee9f24720e80dfb10f47a741f
- SHA1 27aae080bb5b8dfdf61b990df0162c5678efc3be
- SHA512 3f740aadb2ff1764be53b584cf272ff4f5e5517815fa5afb3c8aabfde23830547e8da62b4151969b00109092ba0cf6de828f249704db01b3ac8e2ccdd8d5f47b
- SSDEEP 1536:9ND183dAalnudHyFj6cBSfdYOdMyj5r2h:zD18endsOcBSfaOdMK5r2h
- TLSH
  T1E2339E1AE65E0AF3ED6429B418EBB713A85E580C032487D79F39AC8166D01D82CFD5F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery execution impact persistence ransomware credential_access spyware stealer
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (3747) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2