azov | 9a4763c51db69078d492440d4b12ea98e47c244febb00062af99c9f55bc111d0 | Triage

Sharing

General

Target

2d58b12468fb3c2370077b9b8be43a80N.exe
Size

182KB
Sample

240716-3dryqavfnp
MD5

2d58b12468fb3c2370077b9b8be43a80
SHA1

3e868bbc5eebdbc3a509ff2c2f62640a8cc36102
SHA256

9a4763c51db69078d492440d4b12ea98e47c244febb00062af99c9f55bc111d0
SHA512

710de0c3c7a6a9afff7e65761be7746364c59d2cb4b9b949f4dcaea7bb330b6e74c4f092aad624f5e7b153f2716dea72e71ea4bb2609c30696aeb76450031a44
SSDEEP

3072:oYTO4rdZie0vPUmGbs5WvU39na+ZDPUv3XxjbBiGoN0uESJKZBV2+fFw:o2ZJ0vcmGbvs9VZDPMxsGoN01Ldw

Score

10^/10

azov persistence ransomware spyware stealer wiper

Malware Config

Targets

- Target
  
  2d58b12468fb3c2370077b9b8be43a80N.exe
- Size
  
  182KB
- MD5
  
  2d58b12468fb3c2370077b9b8be43a80
- SHA1
  
  3e868bbc5eebdbc3a509ff2c2f62640a8cc36102
- SHA256
  
  9a4763c51db69078d492440d4b12ea98e47c244febb00062af99c9f55bc111d0
- SHA512
  
  710de0c3c7a6a9afff7e65761be7746364c59d2cb4b9b949f4dcaea7bb330b6e74c4f092aad624f5e7b153f2716dea72e71ea4bb2609c30696aeb76450031a44
- SSDEEP
  
  3072:oYTO4rdZie0vPUmGbs5WvU39na+ZDPUv3XxjbBiGoN0uESJKZBV2+fFw:o2ZJ0vcmGbvs9VZDPMxsGoN01Ldw
Score

10^/10

azov persistence ransomware spyware stealer wiper
- Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Renames multiple (1418) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

azovpersistenceransomwarespywarestealerwiper

behavioral2

azovpersistenceransomwarespywarestealerwiper