azov | 996e9a259a5380131d934b2d32a3a7853844ed80a762289d5bd493b4f43e555d | Triage

Sharing

General

Target

996e9a259a5380131d934b2d32a3a7853844ed80a762289d5bd493b4f43e555d.exe
Size

604KB
Sample

221117-gr1l5ahg5y
MD5

8b5dc8a88675d60b97c017643e83aa92
SHA1

3fa73c55beefb7698354b19bea79c8725cfcd60a
SHA256

996e9a259a5380131d934b2d32a3a7853844ed80a762289d5bd493b4f43e555d
SHA512

a09566ed15dec5f043511d29f00f14b00140a21e129edbc8667d477af754d3ff785c082b6b6e5c08ea4b8b3efac7f92df872ee7f4b6639f1ef242bc95325dde3
SSDEEP

12288:JPY/YvH+/scnWYs9F2E18xGa+sonhMDQQ:Beo+sb2EWxGa4hMDQQ

Score

10^/10

azov persistence ransomware wiper

Malware Config

Targets

- Target
  
  996e9a259a5380131d934b2d32a3a7853844ed80a762289d5bd493b4f43e555d.exe
- Size
  
  604KB
- MD5
  
  8b5dc8a88675d60b97c017643e83aa92
- SHA1
  
  3fa73c55beefb7698354b19bea79c8725cfcd60a
- SHA256
  
  996e9a259a5380131d934b2d32a3a7853844ed80a762289d5bd493b4f43e555d
- SHA512
  
  a09566ed15dec5f043511d29f00f14b00140a21e129edbc8667d477af754d3ff785c082b6b6e5c08ea4b8b3efac7f92df872ee7f4b6639f1ef242bc95325dde3
- SSDEEP
  
  12288:JPY/YvH+/scnWYs9F2E18xGa+sonhMDQQ:Beo+sb2EWxGa4hMDQQ
Score

10^/10

azov persistence ransomware wiper
- Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

azovpersistenceransomwarewiper