MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa2b92d07e6f86bcd56bd1b5d146bedcda1e623028612afab2ee749764046834. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Makop


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa2b92d07e6f86bcd56bd1b5d146bedcda1e623028612afab2ee749764046834
SHA3-384 hash: cfc93d6cc20e0d7831d1bdf23e712e61628c5069ce1d1f46479a24eae8becfc348568e30d4fc7537ffe487a8cb3f971c
SHA1 hash: f9bb603bf27b9fb330e677d8349445c3f74a9658
MD5 hash: 6d29197eefd93853990f53263af114c6
humanhash: red-dakota-avocado-march
File name:makop
Download: download sample
Signature Makop
Create hunting rule
File size:143'360 bytes
First seen:2020-08-03 11:28:22 UTC
Last seen:2020-08-03 12:42:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 275d65a25ffda7a8fbbf1b586852da2d (1 x Makop, 1 x SystemBC)
ssdeep 768:oHGNAbb4PfRiu9+6J4OIFVdV/rZOe8Aeu1KcfGCZp16RqZjpWEvPCb7WJho9ZgHG:JNJ4BrU5ANFfjp1bZFWl7WHoMHRh
TLSH FCE3CF01BFC1D133C02364306465C6B1563EE9321F66994B3B6E12EE5F352E3AABA747
Reporter JAMESWT_WT
Tags:makop

Intelligence

File Origin
# of uploads :
2
# of downloads :
156
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/37740/
Detection(s):
SecuriteInfo.com.Variant.Fugrafa.71307.32146.13779.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Threat name:
Makop
Create hunting rule
Detection:
malicious
Classification:
rans.evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/407806
Signature
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Yara detected Makop ransomware
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa2b92d07e6f86bcd56bd1b5d146bedcda1e623028612afab2ee749764046834/
Threat name:
Win32.Trojan.MintTitirez
Create hunting rule
Status:
Malicious
First seen:
2020-08-03 11:28:15 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ivzfud6n6dlzvll2g25crv63tnb4yrqfbqsv6vs5z2jozaena2a._file
Verdict:
unknown
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/200803-qw6sbq7st6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fa2b92d07e6f86bcd56bd1b5d146bedcda1e623028612afab2ee749764046834

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RANSOM_makop
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect the unpacked Makop ransomware samples
Rule name:win_makop_ransomware_w0
Create hunting rule
Author:@VK_Intel
Description:Detects MAKOP ransomware payload
Reference:https://twitter.com/VK_Intel/status/1242177227682390017

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/37740/

Comments