Overview

overview

10

Static

static

10

2026-09-27...ub.exe

windows10-2004-x64

10

2026-09-27...ub.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-09-27_96d876c087c0bb96cf560af9ddba1555_elex_makop_neshta_ransomhub
  • Size 94KB
  • Sample260928-c43j2atbnd
  • SHA256 2f241685d9d28358b4d052b11d9d932fdcab44abde9d1c119ec634f19964cef9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
makopneshtacredential_accessdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\+README-WARNING+.txt

Ransom Note
  • Dear Management, If you are reading this message, it means that: - your network infrastructure has been compromised, - critical data was leaked, - files are encrypted -------------------------------------------------------------------------- The best and only thing you can do is to contact us to settle the matter before any losses occurs. Mail : [email protected] If you do not receive a response within 12 hours, your letter may not have arrived, in this case we provide an alternative contact Chat qtox : https://tox.chat/download.html Our chat ID : AAB6501458C81B17E9CA1993F1B18BCFB13C9CFB49F70D01560CF0688AF3634F53FA58F31EBA -------------------------------------------------------------------------- 1. THE FOLLOWING IS STRICTLY FORBIDDEN 1.1 EDITING FILES ON HDD. Renaming, copying or moving any files could DAMAGE the cipher and decryption will be impossible. 1.2 USING THIRD-PARTY SOFTWARE. Trying to recover with any software can also break the cipher and file recovery will become a problem. 1.3 SHUTDOWN OR RESTART THE PC. Boot and recovery errors can also damage the cipher. Sorry about that, but doing so is entirely at your own risk. -------------------------------------------------------------------------------------------------- 2. EXPLANATION OF THE SITUATION 2.1 HOW DID THIS HAPPEN The security of your IT perimeter has been compromised (it's not perfect at all). We encrypted your workstations and servers to make the fact of the intrusion visible and to prevent you from hiding critical data leaks. We spent a lot of time researching and finding out the most important directories of your business, your weak points. We have already downloaded a huge amount of critical data and analyzed it. Now its fate is up to you, it will either be deleted or sold, or shared with the media. 2.2 VALUABLE DATA WE USUALLY STEAL: - Databases, legal documents, personal information. - Audit reports. - Audit SQL database - Any financial documents (Statements, invoices, accounting, transfers etc.). - Work files and corporate correspondence. - Any backups. - Confidential documents. 2.3 TO DO LIST (best practies) - Contact us as soon as possible. - Contact us only in our live chat, otherwise you can run into scammers. - Purchase our decryption tool and decrypt your files. There is no other way to do this. - Realize that dealing with us is the shortest way to success and secrecy. - Give up the idea of using decryption help programs, otherwise you will destroy the system permanently. - Avoid any third-party negotiators and recovery groups. They can become the source of leaks. -------------------------------------------------------------------------------------------------- 3. POSSIBLE DECISIONS 3.1 NOT MAKING THE DEAL - After 4 days starting tomorrow your leaked data will be Disclosed or sold. - We will also send the data to all interested supervisory organizations and the media. - Decryption key will be deleted permanently and recovery will be impossible. - Losses from the situation can be measured based on your annual budget. 3.2 MAKING THE WIN-WIN DEAL - You will get the only working Decryption Tool and the how-to-use Manual. - You will get our guarantees (with log provided) of non-recovarable deletion of all your leaked data. - You will get our guarantees of secrecy and removal of all traces related to the deal in the Internet. - You will get our security report on how to fix your security breaches. -------------------------------------------------------------------------------------------------- 4. Your Information and Keys 4.1 All leaked Data samples will be Disclosed in 7 Days if you remain silent. 4.2 Your Decryption keys will be permanently destroyed at the moment the leaked Data is Disclosed. -------------------------------------------------------------------------------------------------- 5. RESPONSIBILITY 5.1 Breaking critical points of this offer will cause: - Deletion of your decryption keys. - Immediate sale or complete Disclosure of your leaked data. - Notification of government supervision agencies, your competitors and clients.
URLs

  • https://tox.chat/download.html

Targets

    • Target
      2026-09-27_96d876c087c0bb96cf560af9ddba1555_elex_makop_neshta_ransomhub
    • Size 94KB
    • SHA256 2f241685d9d28358b4d052b11d9d932fdcab44abde9d1c119ec634f19964cef9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionmakopneshtaimpactpersistenceransomwarespywarestealercredential_access

    • Detect Neshta payload

    • Family: Makop

      Ransomware family discovered by @VK_Intel in early 2020.

      ransomwaremakop

    • Family: Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • MAKOP ransomware payload

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Renames multiple (3596) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Credentials from Password Stores: Windows Credential Manager

      Suspicious access to Credentials History.

      credential_accessstealer

    • Executes dropped EXE

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Management Instrumentation

1
T1047

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Direct Volume Access

1
T1006

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

2
T1555

Credentials from Web Browsers

1
T1555.003

Windows Credential Manager

1
T1555.004

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

6
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

3
T1490

Tasks