azov | 18de2031728646abf95827d0cf314420b406f6eef24f8aed9129fcabf5af0567 | Triage

Sharing

General

Target

18de2031728646abf95827d0cf314420b406f6eef24f8aed9129fcabf5af0567
Size

275KB
Sample

221114-f87akaab7x
MD5

bead4612d380a3428978d6a7ea7650c1
SHA1

5ba5ee43f13aa2dfbfc50f9d089776fbea29f4ea
SHA256

18de2031728646abf95827d0cf314420b406f6eef24f8aed9129fcabf5af0567
SHA512

a3cf921e7f7fefadc9fe59d3c2447153126293232b729c98e7835c707dec75fa76ef83ec4c7ffdc2addf16876b194bd2055faf42efe1bfec5d03b14eb99fd21b
SSDEEP

6144:3797b3s9kWGNTNYdMzATVkQNUO7q55vglfStNDCTi:LxLs9ZGNTCWsTGQ47v1tNQi

Score

10^/10

azov persistence ransomware wiper

Malware Config

Targets

- Target
  
  18de2031728646abf95827d0cf314420b406f6eef24f8aed9129fcabf5af0567
- Size
  
  275KB
- MD5
  
  bead4612d380a3428978d6a7ea7650c1
- SHA1
  
  5ba5ee43f13aa2dfbfc50f9d089776fbea29f4ea
- SHA256
  
  18de2031728646abf95827d0cf314420b406f6eef24f8aed9129fcabf5af0567
- SHA512
  
  a3cf921e7f7fefadc9fe59d3c2447153126293232b729c98e7835c707dec75fa76ef83ec4c7ffdc2addf16876b194bd2055faf42efe1bfec5d03b14eb99fd21b
- SSDEEP
  
  6144:3797b3s9kWGNTNYdMzATVkQNUO7q55vglfStNDCTi:LxLs9ZGNTCWsTGQ47v1tNQi
Score

10^/10

azov persistence ransomware wiper
- Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

azovpersistenceransomwarewiper

behavioral2

azovpersistenceransomwarewiper