azov | 3dc0308e29069ddbcefe093a911c3128d95fbfaf216e7b6e1c4e7fdac0b0fa07 | Triage

Sharing

General

Target

2025-03-06_7bca4c824f8554906c2750b38280b071_ryuk
Size

1.6MB
Sample

250306-tw93kssxcy
MD5

7bca4c824f8554906c2750b38280b071
SHA1

1a3dc67ae7b24afbace86fef2d1f83aec53e20ed
SHA256

3dc0308e29069ddbcefe093a911c3128d95fbfaf216e7b6e1c4e7fdac0b0fa07
SHA512

9137904061fe6e98583c5009f36bc774903e2ed2c4646160bd2e1f2e3769509e50f1ff10f99836d1417f17eff5ff9259a2dd7c9740676568c534982ffdc57514
SSDEEP

49152:W5yhIWQhAanDmFJdgP3e73gdf1R6bJ11DTKDcC/WE:ymFJdg/qNsWE

Score

10^/10

azov persistence ransomware wiper

Malware Config

Targets

- Target
  
  2025-03-06_7bca4c824f8554906c2750b38280b071_ryuk
- Size
  
  1.6MB
- MD5
  
  7bca4c824f8554906c2750b38280b071
- SHA1
  
  1a3dc67ae7b24afbace86fef2d1f83aec53e20ed
- SHA256
  
  3dc0308e29069ddbcefe093a911c3128d95fbfaf216e7b6e1c4e7fdac0b0fa07
- SHA512
  
  9137904061fe6e98583c5009f36bc774903e2ed2c4646160bd2e1f2e3769509e50f1ff10f99836d1417f17eff5ff9259a2dd7c9740676568c534982ffdc57514
- SSDEEP
  
  49152:W5yhIWQhAanDmFJdgP3e73gdf1R6bJ11DTKDcC/WE:ymFJdg/qNsWE
Score

10^/10

persistence azov ransomware wiper
- Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Azov family
  azov
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

azovpersistenceransomwarewiper