azov | 7387be3a248d4bf8485252d6557e2041d171d5a6afd12776fbfd4ebdbad39738 | Triage

Sharing

General

Target

a15b3a0bf5a71bc6c19b9d6c95fc6e18
Size

678KB
Sample

231215-d4kvnabfe9
MD5

a15b3a0bf5a71bc6c19b9d6c95fc6e18
SHA1

cf1bc61dd81992765b6b16ea6db2d9f4c16f0ae2
SHA256

7387be3a248d4bf8485252d6557e2041d171d5a6afd12776fbfd4ebdbad39738
SHA512

65bba9ac64034a07ea842bd65bd705cbd826117a525e4256a72f794b42cca6d0e0922f46ac6ce29c9b84f4304195a2e1de7eda25e37fc6e4cdda932316051772
SSDEEP

6144:zXPzy80tYP831a/QbAJMvsb7c7fQ9H/8p9zvmTOVs9DofEAQZ57HkNWyxRg6Vskd:bzFfSaMAGvsE72c9zZVs9GLQv9yfBVj

Score

10^/10

azov persistence ransomware wiper

Malware Config

Targets

- Target
  
  a15b3a0bf5a71bc6c19b9d6c95fc6e18
- Size
  
  678KB
- MD5
  
  a15b3a0bf5a71bc6c19b9d6c95fc6e18
- SHA1
  
  cf1bc61dd81992765b6b16ea6db2d9f4c16f0ae2
- SHA256
  
  7387be3a248d4bf8485252d6557e2041d171d5a6afd12776fbfd4ebdbad39738
- SHA512
  
  65bba9ac64034a07ea842bd65bd705cbd826117a525e4256a72f794b42cca6d0e0922f46ac6ce29c9b84f4304195a2e1de7eda25e37fc6e4cdda932316051772
- SSDEEP
  
  6144:zXPzy80tYP831a/QbAJMvsb7c7fQ9H/8p9zvmTOVs9DofEAQZ57HkNWyxRg6Vskd:bzFfSaMAGvsE72c9zZVs9GLQv9yfBVj
Score

10^/10

azov persistence ransomware wiper
- Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

azovpersistenceransomwarewiper

behavioral2