azov | 05815418cfc42049037a3aee0cab64353d01bb2003b88faf7a89258b40d6b3b9 | Triage

Sharing

General

Target

d610608364afbb4dcfd94365f718c65d
Size

420KB
Sample

231018-pap33afe33
MD5

d610608364afbb4dcfd94365f718c65d
SHA1

a19856f233e0ce641550b4470ea8e32e7ddeaba5
SHA256

05815418cfc42049037a3aee0cab64353d01bb2003b88faf7a89258b40d6b3b9
SHA512

048769f7f23a85820dca60fa514be1a6cd537eb8fae1735c782af3c87982144ae2a8918e80e8488114156c180818a9d896b038a3cd3bac82fe0efb3289b7b20e
SSDEEP

6144:rbyAijbEY1ZOCGY8hvMC50Os9bvAtYVOt+UFIo1npo8W18Uex9fq:reAUFElUA0Os97OApYQiUSfq

Score

10^/10

azov persistence ransomware wiper

Malware Config

Targets

- Target
  
  d610608364afbb4dcfd94365f718c65d
- Size
  
  420KB
- MD5
  
  d610608364afbb4dcfd94365f718c65d
- SHA1
  
  a19856f233e0ce641550b4470ea8e32e7ddeaba5
- SHA256
  
  05815418cfc42049037a3aee0cab64353d01bb2003b88faf7a89258b40d6b3b9
- SHA512
  
  048769f7f23a85820dca60fa514be1a6cd537eb8fae1735c782af3c87982144ae2a8918e80e8488114156c180818a9d896b038a3cd3bac82fe0efb3289b7b20e
- SSDEEP
  
  6144:rbyAijbEY1ZOCGY8hvMC50Os9bvAtYVOt+UFIo1npo8W18Uex9fq:reAUFElUA0Os97OApYQiUSfq
Score

10^/10

persistence azov ransomware wiper
- Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

azovpersistenceransomwarewiper