azov | fc56f94abae1ce53359cc5188c6687258b2c955ffbf1716405918929f9472006 | Triage

Sharing

General

Target

325727171c97027477a0de05486042fd6ee98160994100ad900b528cff475d5c.zip
Size

264KB
Sample

221115-gxfh5sfb78
MD5

2fae9a8ce00fb2652eb186b371d228d3
SHA1

014c320ae334c740807ada721b17b7f48da14267
SHA256

fc56f94abae1ce53359cc5188c6687258b2c955ffbf1716405918929f9472006
SHA512

ed1429b2158b9ae85bcb292687338b1e5ee0fe20f901eb518735fc1dcdadac456dac96875991fedbeb6a926e65637a7418272f2b669d0851e113af157d7957d8
SSDEEP

6144:qBqVE93KhsnJ9rOUSpoaemydavT1FFERFT7DeQJYJD5v:3ElvnPaRydK1fEWb55v

Score

10^/10

azov persistence ransomware wiper

Malware Config

Targets

- Target
  
  325727171c97027477a0de05486042fd6ee98160994100ad900b528cff475d5c.exe
- Size
  
  500KB
- MD5
  
  b2e0fcbef184c936027f2026958b6149
- SHA1
  
  cf1711ed4b3e4feac9d8b1855e11cbf3f4480a39
- SHA256
  
  325727171c97027477a0de05486042fd6ee98160994100ad900b528cff475d5c
- SHA512
  
  b28ec4ffba9784aed9527c4e345c2dd346491172420b114e5f860b9d8ca2d82b5596e244fee381143ab6ff6235f9ae9ff0bd92c125819d5ea603e9fffa5bd108
- SSDEEP
  
  6144:cTK4JBQ/nFoILwe105aL8EFI+Ks9e+xfjJxo+XUNS5agAuh6DIheyVk/AUbgZjDT:/4ESr5aYLs93x1x1U0APukQIHbE0zlO
Score

10^/10

azov persistence ransomware wiper
- Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

azovpersistenceransomwarewiper