azov | 0fa41f0c15ca21fc1f51adec620dae3dbe003a2033c16c48b93b6b04ded1ce32 | Triage

Sharing

General

Target

0fa41f0c15ca21fc1f51adec620dae3dbe003a2033c16c48b93b6b04ded1ce32
Size

139KB
Sample

240613-x1tsyaycld
MD5

5fd81018da16f4d498912c8dbea0ae04
SHA1

2f415ea5e7f9a87a937eed4bd9b55c8680101886
SHA256

0fa41f0c15ca21fc1f51adec620dae3dbe003a2033c16c48b93b6b04ded1ce32
SHA512

61587e48499e7402dcd57aa89de83a39f91d572b11a181398b876cc3b2607ad89763aa7376c876aa0eeccd4e8b0922c24b4e8705ddf9f3e0d2b7649ff2f29b10
SSDEEP

3072:hU39KCPcw3wENjZqMNixRelzzYJ9fE++6:hs9XhwEPv4eiJ98+h

Score

10^/10

azov persistence ransomware spyware stealer wiper

Malware Config

Targets

- Target
  
  0fa41f0c15ca21fc1f51adec620dae3dbe003a2033c16c48b93b6b04ded1ce32
- Size
  
  139KB
- MD5
  
  5fd81018da16f4d498912c8dbea0ae04
- SHA1
  
  2f415ea5e7f9a87a937eed4bd9b55c8680101886
- SHA256
  
  0fa41f0c15ca21fc1f51adec620dae3dbe003a2033c16c48b93b6b04ded1ce32
- SHA512
  
  61587e48499e7402dcd57aa89de83a39f91d572b11a181398b876cc3b2607ad89763aa7376c876aa0eeccd4e8b0922c24b4e8705ddf9f3e0d2b7649ff2f29b10
- SSDEEP
  
  3072:hU39KCPcw3wENjZqMNixRelzzYJ9fE++6:hs9XhwEPv4eiJ98+h
Score

10^/10

azov persistence ransomware spyware stealer wiper
- Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Renames multiple (1138) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

azovpersistenceransomwarespywarestealerwiper

behavioral2

azovpersistenceransomwarespywarestealerwiper