Overview
overview
3Static
static
1SAAZOD/Agn...ID.exe
windows10-2004-x64
3SAAZOD/Agn...ID.exe
windows11-21h2-x64
3SAAZOD/Bas...sk.dll
windows10-2004-x64
3SAAZOD/Bas...sk.dll
windows11-21h2-x64
3SAAZOD/Bas...fo.dll
windows10-2004-x64
3SAAZOD/Bas...fo.dll
windows11-21h2-x64
3SAAZOD/Bas...et.exe
windows10-2004-x64
3SAAZOD/Bas...et.exe
windows11-21h2-x64
3SAAZOD/Bas...ed.dll
windows10-2004-x64
3SAAZOD/Bas...ed.dll
windows11-21h2-x64
3SAAZOD/Chi...t2.dll
windows10-2004-x64
3SAAZOD/Chi...t2.dll
windows11-21h2-x64
3SAAZOD/ChilkatXml.dll
windows10-2004-x64
3SAAZOD/ChilkatXml.dll
windows11-21h2-x64
3SAAZOD/Chi...p2.dll
windows10-2004-x64
3SAAZOD/Chi...p2.dll
windows11-21h2-x64
3SAAZOD/ClearLogs.exe
windows10-2004-x64
3SAAZOD/ClearLogs.exe
windows11-21h2-x64
3SAAZOD/DMP...sk.exe
windows10-2004-x64
3SAAZOD/DMP...sk.exe
windows11-21h2-x64
3SAAZOD/SAA...TL.exe
windows10-2004-x64
3SAAZOD/SAA...TL.exe
windows11-21h2-x64
3SAAZOD/SAA...xe.exe
windows10-2004-x64
3SAAZOD/SAA...xe.exe
windows11-21h2-x64
3SAAZOD/SAA...ad.exe
windows10-2004-x64
3SAAZOD/SAA...ad.exe
windows11-21h2-x64
3SAAZOD/SAAZKill.exe
windows10-2004-x64
3SAAZOD/SAAZKill.exe
windows11-21h2-x64
3SAAZOD/SAA...rt.exe
windows10-2004-x64
3SAAZOD/SAA...rt.exe
windows11-21h2-x64
3SAAZOD/SAA...er.exe
windows10-2004-x64
3SAAZOD/SAA...er.exe
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
114s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 12:25
Static task
static1
Behavioral task
behavioral1
Sample
SAAZOD/AgntUninstallPID.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
SAAZOD/AgntUninstallPID.exe
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
SAAZOD/BaseComponents/Asset/SmartDisk.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
SAAZOD/BaseComponents/Asset/SmartDisk.dll
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
SAAZOD/BaseComponents/Asset/SysInfo.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
SAAZOD/BaseComponents/Asset/SysInfo.dll
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
SAAZOD/BaseComponents/Asset/zAsset.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
SAAZOD/BaseComponents/Asset/zAsset.exe
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
SAAZOD/BaseComponents/Asset/zIsSmartEnabled.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral10
Sample
SAAZOD/BaseComponents/Asset/zIsSmartEnabled.dll
Resource
win11-20260130-en
Behavioral task
behavioral11
Sample
SAAZOD/ChilkatCrypt2.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral12
Sample
SAAZOD/ChilkatCrypt2.dll
Resource
win11-20260130-en
Behavioral task
behavioral13
Sample
SAAZOD/ChilkatXml.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral14
Sample
SAAZOD/ChilkatXml.dll
Resource
win11-20260130-en
Behavioral task
behavioral15
Sample
SAAZOD/ChilkatZip2.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral16
Sample
SAAZOD/ChilkatZip2.dll
Resource
win11-20260130-en
Behavioral task
behavioral17
Sample
SAAZOD/ClearLogs.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral18
Sample
SAAZOD/ClearLogs.exe
Resource
win11-20260130-en
Behavioral task
behavioral19
Sample
SAAZOD/DMPHelpDesk.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral20
Sample
SAAZOD/DMPHelpDesk.exe
Resource
win11-20260130-en
Behavioral task
behavioral21
Sample
SAAZOD/SAAZDPMACTL.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral22
Sample
SAAZOD/SAAZDPMACTL.exe
Resource
win11-20260130-en
Behavioral task
behavioral23
Sample
SAAZOD/SAAZDefaultJobExe.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral24
Sample
SAAZOD/SAAZDefaultJobExe.exe
Resource
win11-20260130-en
Behavioral task
behavioral25
Sample
SAAZOD/SAAZJobDownload.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral26
Sample
SAAZOD/SAAZJobDownload.exe
Resource
win11-20260130-en
Behavioral task
behavioral27
Sample
SAAZOD/SAAZKill.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral28
Sample
SAAZOD/SAAZKill.exe
Resource
win11-20260130-en
Behavioral task
behavioral29
Sample
SAAZOD/SAAZRemoteSupport.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral30
Sample
SAAZOD/SAAZRemoteSupport.exe
Resource
win11-20260130-en
Behavioral task
behavioral31
Sample
SAAZOD/SAAZScheduler.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral32
Sample
SAAZOD/SAAZScheduler.exe
Resource
win11-20260130-en
General
- Target SAAZOD/SAAZJobDownload.exe
- Size 98KB
- Sample260424-plnpdaat7p
- SHA256 0ef1dd127d448b982b2021255140a9a40e92ed8edcab249bec8b6a5df37be04b
- MD5 b9cc894682f48a535198da38088b60ce
- SHA1 ea60165647f92adf0eda1b0a50e15618210c6fbf
- SHA512 c671e9236b8141202c3e1520dbc2b163f73d96426baef686674649a1a7d0b970741f1b1e8a6dc26c9307ceabc9803f805ce0350bb86b91dc7459220e7fa6b21d
- SSDEEP 1536:E2NH1p+sHJJr6owyyZUSJYYIbtTZPlLaAuXFHoRAQH7wl:EmH1p+spJr6HuAYffgNFHoRAQH8l
- TLSH T14BA38E23B8E18471F695843139B49FBFAB7EB93519214CC3B35CDA1A1E316C1462E2DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAAZJobDownload.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 480 SAAZJobDownload.exe