azov | 145d1a3180a70a80f84cb90990ee7b2e78eb46a1ce42fb489c3932c6699a252e | Triage

Sharing

General

Target

9d5991b57f31ddcfb32526beb6152e5a.bin
Size

293KB
Sample

240206-ddsgtadha2
MD5

9d5991b57f31ddcfb32526beb6152e5a
SHA1

114662bae52549b2e7239bd28c243a225cdcad85
SHA256

145d1a3180a70a80f84cb90990ee7b2e78eb46a1ce42fb489c3932c6699a252e
SHA512

d317c361bde8e3257bf34b22a79a7dc30955a66f59a3faf9261038567a44ae75f24669ce51b9e02ca3c74b2f224658a3c32cb83dc61600e7e76c28a51d0fee8f
SSDEEP

6144:nmJr5mzs9HJzcMSKwvscBC21XDugPc7EFYWUdp4qWUdEMOv/otHlVfDZj2nz:mB5mzs9HJwhKwvjBxad1ii1ZW

Score

10^/10

azov persistence ransomware wiper

Malware Config

Targets

- Target
  
  9d5991b57f31ddcfb32526beb6152e5a.bin
- Size
  
  293KB
- MD5
  
  9d5991b57f31ddcfb32526beb6152e5a
- SHA1
  
  114662bae52549b2e7239bd28c243a225cdcad85
- SHA256
  
  145d1a3180a70a80f84cb90990ee7b2e78eb46a1ce42fb489c3932c6699a252e
- SHA512
  
  d317c361bde8e3257bf34b22a79a7dc30955a66f59a3faf9261038567a44ae75f24669ce51b9e02ca3c74b2f224658a3c32cb83dc61600e7e76c28a51d0fee8f
- SSDEEP
  
  6144:nmJr5mzs9HJzcMSKwvscBC21XDugPc7EFYWUdp4qWUdEMOv/otHlVfDZj2nz:mB5mzs9HJwhKwvjBxad1ii1ZW
Score

10^/10

persistence azov ransomware wiper
- Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

azovpersistenceransomwarewiper