azov | 4ba82612c95063996d8576ac96fb570845fc7826d5cdc571c24a07a3c967d0b8 | Triage

Sharing

General

Target

2024-06-11_32a690c021208b450ac8c174fcf7300d_ryuk
Size

664KB
Sample

240611-p1wcrsxgmq
MD5

32a690c021208b450ac8c174fcf7300d
SHA1

7491b337541c9e9531b65a15e31c0e16ccc39796
SHA256

4ba82612c95063996d8576ac96fb570845fc7826d5cdc571c24a07a3c967d0b8
SHA512

9f3806b8e5c7c34fa71bb584a2322a2a4eab88818aaf4fb182bb48d48d57c670741659da295624c8b51773e1cc192c950eeeb0e1af1ae8e6d82b5300ca9ec669
SSDEEP

12288:is9ge6iSoCU5qJSr1eFt1U1Mqee4e0qbDgsA7HUzTshDsZfvGmW:m8SoCU5qJSr1en18l4e0qbDgsKeT+so

Score

10^/10

azov persistence ransomware spyware stealer wiper

Malware Config

Targets

- Target
  
  2024-06-11_32a690c021208b450ac8c174fcf7300d_ryuk
- Size
  
  664KB
- MD5
  
  32a690c021208b450ac8c174fcf7300d
- SHA1
  
  7491b337541c9e9531b65a15e31c0e16ccc39796
- SHA256
  
  4ba82612c95063996d8576ac96fb570845fc7826d5cdc571c24a07a3c967d0b8
- SHA512
  
  9f3806b8e5c7c34fa71bb584a2322a2a4eab88818aaf4fb182bb48d48d57c670741659da295624c8b51773e1cc192c950eeeb0e1af1ae8e6d82b5300ca9ec669
- SSDEEP
  
  12288:is9ge6iSoCU5qJSr1eFt1U1Mqee4e0qbDgsA7HUzTshDsZfvGmW:m8SoCU5qJSr1en18l4e0qbDgsKeT+so
Score

10^/10

azov persistence ransomware spyware stealer wiper
- Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Renames multiple (1239) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

azovpersistenceransomwarespywarestealerwiper

behavioral2

azovpersistenceransomwarespywarestealerwiper