MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 a617fdbff227afe8c89ba96d34724fb03c0c08857c508c8c80f3fedc916fe2b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Ransomare.Makop
Vendor detections: 11
| SHA256 hash: | a617fdbff227afe8c89ba96d34724fb03c0c08857c508c8c80f3fedc916fe2b4 |
|---|---|
| SHA3-384 hash: | 1fd1df26498b499a17ad8b9725f1d97fccf9542be94c5f5f77048ce21a36ae50f78f8cbb8b9d9ac9ce4902fc8edd0746 |
| SHA1 hash: | efde96d76f372f2f31a017a7f83ea5ed87905614 |
| MD5 hash: | 5d8ae8c788d8f89b6bbe4b94f77d0181 |
| humanhash: | idaho-cup-monkey-wolfram |
| File name: | 입사지원서_220109(경력사항도 같이 기재하였습니다 잘부탁드립니다).exe |
| Download: | download sample |
| Signature | Ransomare.Makop |
| File size: | 3'032'820 bytes |
| First seen: | 2022-01-10 03:19:24 UTC |
| Last seen: | 2022-01-10 04:30:06 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 56a78d55f3f7af51443e58e0ce2fb5f6 (720 x GuLoader, 451 x Formbook, 295 x Loki) |
| ssdeep | 49152:+yrMQjbcDLasp30MinHKQ3TqR9FhvFrcDLasp30MinHKQ3TqR9FhvF5qI:+yrMQjbcPV0FnHKQ3mhv5cPV0FnHKQ3U |
| Threatray | 306 similar samples on MalwareBazaar |
| TLSH | T10AE5E0E6E4405945F82F0BB2F8B66DB304471D7B94BC2B8C398A3B5245F7DA5103E98B |
| File icon (PE): |  |
| dhash icon | 3361a5a5a5a56133 (1 x Ransomare.Makop) |
| Reporter |  fbgwls245 |
| Tags: | exe makop Ransomare.Makop Ransomware |
Intelligence
File Origin
# of uploads :
2
# of downloads :
536
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
입사지원서_220109(경력사항도 같이 기재하였습니다 잘부탁드립니다).exe
Verdict:
Suspicious activity
Analysis date:
2022-01-10 03:20:24 UTC
Tags:
ransomware makop oled
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
DNS request
Sending a custom TCP request
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
80%
Tags:
control.exe expand.exe fingerprint overlay packed shell32.dll
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
Oled
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Signature
Creates files in the recycle bin to hide itself
Creates files inside the volume driver (system volume information)
Deletes shadow drive data (may be related to ransomware)
Deletes the backup plan of Windows
Found evasive API chain (may stop execution after checking mutex)
Found ransom note / readme
Injects a PE file into a foreign processes
May disable shadow drive data (uses vssadmin)
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for submitted file
Opens the same file many times (likely Sandbox evasion)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Sigma detected: WannaCry Ransomware
Writes many files with high entropy
Yara detected Oled Ransomware
Behaviour
Behavior Graph:
Threat name:
Win32.Ransomware.Phobos
Status:
Malicious
First seen:
2022-01-10 03:20:20 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
16 of 28 (57.14%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 296 additional samples on MalwareBazaar
Result
Malware family:
makop
Score:
10/10
Tags:
family:makop ransomware spyware stealer
Behaviour
Checks SCSI registry key(s)
Interacts with shadow copies
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Legitimate hosting services abused for malware hosting/C2
Loads dropped DLL
Reads user/profile data of web browsers
Deletes backup catalog
Deletes shadow copies
Makop
Unpacked files
SH256 hash:
17418c2239e7f5a21f4c66b5d1acc5df43bb7e68a40550400d3aeeb4f074fe65
MD5 hash:
52547a94a117a595a5dadf88d8447c7b
SHA1 hash:
509890898a20ea112fc50b7d33f2de866a7c7ed8
SH256 hash:
ac553372db44443b2d523fe0d6cb865f37ba80278a392ea11a43599eea2999c5
MD5 hash:
3a3a85372958c2fd2e05694609e16b1b
SHA1 hash:
91485589083064b7aaa898ed59fbdf79fe88a6d0
SH256 hash:
a617fdbff227afe8c89ba96d34724fb03c0c08857c508c8c80f3fedc916fe2b4
MD5 hash:
5d8ae8c788d8f89b6bbe4b94f77d0181
SHA1 hash:
efde96d76f372f2f31a017a7f83ea5ed87905614
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Distributed via e-mail link
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.