Indicator (IOC)
Essential information
- Value / Name
c2524bfd199c23458ade0c2f449510af017d7321- Confidence
- 100/100
- Revoked
- Yes
- Valid from
- 29/03/2023 23:27
- Valid until
- 01/07/2024 23:27
- Pattern type
- yara
- Published
- 20/12/2025 19:38
- Modified
- 20/12/2025 23:47
- Author / Source
- AlienVault
Description
puffedup tool in makop ransomware toolkit
Pattern
import "pe"
rule PuffedUp{ meta: author= "@luc4m" date= "20230312" modified= "20230312" hash= "e245f8d129e8eadb00e165c569a14b71" description="puffedup tool in makop ransomware toolkit" tlp="CLEAR" strings: $main_1 = { 00 72 [4] 28 [4] 00 72 [4] 0A 72 [4] 28 [4] 00 29 } $main_2 = { 0B 07 28 [4] 80 [4] 28 [4] 00 2A } $sash_3 = { 72 [4] 0C [4] 72 [4] 0D 28 [4] 13 08 2C 06 } $sash_4 = { 16 FE 01 13 0C 11 0C 2C 17 11 08 } $sash_5 = { 1c 0D 00 20 [4] 28 [4] 00 00 DE 00 } condition: uint16(0) == 0x5a4d and pe.imports("mscoree.dll") and ( 2 of ($sash_*) or 1 of ($main_*) ) }Labels / Tags
Marking (TLP)
TLP:CLEAR