azov | 4b7f7b20984be95326582cdd2aa38f78d3b90255b74453c0cabf1bbc780d74c7

General

Target
jaffacakes118_samples.part024.rar
Size 15.0MB
Sample261011-v6yyqsys4q
SHA256 4b7f7b20984be95326582cdd2aa38f78d3b90255b74453c0cabf1bbc780d74c7
MD5 362e519f5f72da016b001380db9b23b5
SHA1 df1b335baa7a7f3486d801befaeb56ca3280aaad
SHA512 cf0f3a430d8aab8f05472c8c036e6ec983cef1feacdf9e14e7baca39cbbd8f4b881ee847b54511e91de085499d5f924e3d66d63b77dbd66dff9e1ce48acd2e0c
SSDEEP 393216:oVE+OqXiEf3vtw4IcwXEKzZuS4U7hnBVeZ9oZVeAApJqTBFewZV7X:CE+OYZwhcw0mJ4U7hnBV+wYAIM9wS
TLSH
T11EF633DF34E5B315EAD065356539BBA6C10BE0630BE1E133A291B1D1AC14E8E372BE19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\+README-WARNING+.txt

makop

Ransom Note

::: Greetings ::: Little FAQ: .1. Q: Whats Happen? A: Your files have been encrypted. The file structure was not damaged, we did everything possible so that this could not happen. .2. Q: How to recover files? A: If you wish to decrypt your files you will need to pay us. .3. Q: What about guarantees? A: Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, you can send to us any 2 files with SIMPLE extensions(jpg,xls,doc, etc... not databases!) and low sizes(max 1 mb), we will decrypt them and send back to you. That is our guarantee. .4. Q: How to contact with you? A: You can write us to our mailboxes: [email protected] or [email protected] .5. Q: How will the decryption process proceed after payment? A: After payment we will send to you our scanner-decoder program and detailed instructions for use. With this program you will be able to decrypt all your encrypted files. .6. Q: If I don�t want to pay bad people like you? A: If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause only we have the private key. In practice - time is much more valuable than money. :::BEWARE::: DON'T try to change encrypted files by yourself! If you will try to use any third party software for restoring your data or antivirus solutions - please make a backup for all encrypted files! Any changes in encrypted files may entail damage of the private key and, as result, the loss all data.

Emails

Targets

- Target
  a3ea2c531278faee7c468c005f8bb81acf6bbde82e3afa6d421d8f29d951de9c.exe
- Size 155KB
- SHA256 a3ea2c531278faee7c468c005f8bb81acf6bbde82e3afa6d421d8f29d951de9c
- MD5 c6b9df56d59434f0be9df13759ec394e
- SHA1 dc61474b35df1e8b71ff421ff4dda70efffba9b7
- SHA512 38ce9111f807103b75ea8d6440bac0988462640d2949d98f4f90b4bfe7c7a8a07ac500ea05c7b47276e0283ee527145f54feb5d7ac2337249d092e125d4370d0
- SSDEEP 3072:l5K/B0toLQSNJslZHQsozTS+SMqqDL2/TrKvaG:lcytwtU1yTS+xqqDL6HKr
- TLSH
  T178F38C1971D1A0B2E4F30976D5B8AF12446DFC111BB07CDB72E61A9E19320E3AE39B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  a3f6679f856ce665166f3979520936ce148fb216be6ea509fd8f527256191fe5.exe
- Size 49KB
- SHA256 a3f6679f856ce665166f3979520936ce148fb216be6ea509fd8f527256191fe5
- MD5 820b2a78fc3d3b5eeea7d3a539a548aa
- SHA1 34748995c3e2af7fcd5b146fd354eb4dbf599fa0
- SHA512 410e0222779b67b05c860aebe38a71fe7cff92b75a814e949b685e294f793a3bea9144ef0c6c2a3460ae143937b15dd5da051799ea12bbb258bbe5a50baf7837
- SSDEEP 768:KaQRffqVB31aCytHLykiKPT3JATD2qBwV2ckjbnsb0Ah99De0YADk7dSVfj13L7e:Kabv318HxZATvnsblYOk7d4JHU
- TLSH
  T1E6338D6BAFC0A8F3FDA529B412DAB697A8DE6C0C035493D39F24AD4065605E07CFD1C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution makop impact persistence ransomware
- Family: Makop
  Ransomware family discovered by @VK_Intel in early 2020.
  ransomware makop
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Renames multiple (3649) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Deletes backup catalog
  Uses wbadmin.exe to inhibit system recovery.
  ransomware
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  a4a6ee276fc98d6735f34c917bdfbbf5c7d4b955e6f1ce1b03505509b408e4fc.exe
- Size 3.7MB
- SHA256 a4a6ee276fc98d6735f34c917bdfbbf5c7d4b955e6f1ce1b03505509b408e4fc
- MD5 c84978a220b2b871198a3db451615500
- SHA1 b3849898825e31ca9786f452934a9e40eba0bc56
- SHA512 d7211c095b27b948344fae05735722bf69cfd18c2d1bff8a3613bc48792985f0eea2a094a8b6aaee2caa3b31e6294bfd73b66aed2294cc65fa65e375c8e750b4
- SSDEEP 49152:el7YUljH6Y0Fj33lRzgFLeUpO8VfTFZ1bBzP7n1Y8/17MVfw1QSXm+RFvTCr9lt1:e1OkfTFFqRlw6a+91
- TLSH
  T1C6065B03E2F941D8F0BAD678DB258736DA72BC854B34A1DF129056191E76FE09F38722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery azov persistence ransomware spyware stealer wiper
- Family: Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Renames multiple (6666) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6