Overview
overview
3Static
static
1SAAZOD/Agn...ID.exe
windows10-2004-x64
3SAAZOD/Agn...ID.exe
windows11-21h2-x64
3SAAZOD/Bas...sk.dll
windows10-2004-x64
3SAAZOD/Bas...sk.dll
windows11-21h2-x64
3SAAZOD/Bas...fo.dll
windows10-2004-x64
3SAAZOD/Bas...fo.dll
windows11-21h2-x64
3SAAZOD/Bas...et.exe
windows10-2004-x64
3SAAZOD/Bas...et.exe
windows11-21h2-x64
3SAAZOD/Bas...ed.dll
windows10-2004-x64
3SAAZOD/Bas...ed.dll
windows11-21h2-x64
3SAAZOD/Chi...t2.dll
windows10-2004-x64
3SAAZOD/Chi...t2.dll
windows11-21h2-x64
3SAAZOD/ChilkatXml.dll
windows10-2004-x64
3SAAZOD/ChilkatXml.dll
windows11-21h2-x64
3SAAZOD/Chi...p2.dll
windows10-2004-x64
3SAAZOD/Chi...p2.dll
windows11-21h2-x64
3SAAZOD/ClearLogs.exe
windows10-2004-x64
3SAAZOD/ClearLogs.exe
windows11-21h2-x64
3SAAZOD/DMP...sk.exe
windows10-2004-x64
3SAAZOD/DMP...sk.exe
windows11-21h2-x64
3SAAZOD/SAA...TL.exe
windows10-2004-x64
3SAAZOD/SAA...TL.exe
windows11-21h2-x64
3SAAZOD/SAA...xe.exe
windows10-2004-x64
3SAAZOD/SAA...xe.exe
windows11-21h2-x64
3SAAZOD/SAA...ad.exe
windows10-2004-x64
3SAAZOD/SAA...ad.exe
windows11-21h2-x64
3SAAZOD/SAAZKill.exe
windows10-2004-x64
3SAAZOD/SAAZKill.exe
windows11-21h2-x64
3SAAZOD/SAA...rt.exe
windows10-2004-x64
3SAAZOD/SAA...rt.exe
windows11-21h2-x64
3SAAZOD/SAA...er.exe
windows10-2004-x64
3SAAZOD/SAA...er.exe
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 12:25
Static task
static1
Behavioral task
behavioral1
Sample
SAAZOD/AgntUninstallPID.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
SAAZOD/AgntUninstallPID.exe
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
SAAZOD/BaseComponents/Asset/SmartDisk.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral4
Sample
SAAZOD/BaseComponents/Asset/SmartDisk.dll
Resource
win11-20260130-en
Behavioral task
behavioral5
Sample
SAAZOD/BaseComponents/Asset/SysInfo.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral6
Sample
SAAZOD/BaseComponents/Asset/SysInfo.dll
Resource
win11-20260130-en
Behavioral task
behavioral7
Sample
SAAZOD/BaseComponents/Asset/zAsset.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral8
Sample
SAAZOD/BaseComponents/Asset/zAsset.exe
Resource
win11-20260130-en
Behavioral task
behavioral9
Sample
SAAZOD/BaseComponents/Asset/zIsSmartEnabled.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral10
Sample
SAAZOD/BaseComponents/Asset/zIsSmartEnabled.dll
Resource
win11-20260130-en
Behavioral task
behavioral11
Sample
SAAZOD/ChilkatCrypt2.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral12
Sample
SAAZOD/ChilkatCrypt2.dll
Resource
win11-20260130-en
Behavioral task
behavioral13
Sample
SAAZOD/ChilkatXml.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral14
Sample
SAAZOD/ChilkatXml.dll
Resource
win11-20260130-en
Behavioral task
behavioral15
Sample
SAAZOD/ChilkatZip2.dll
Resource
win10v2004-20260130-en
Behavioral task
behavioral16
Sample
SAAZOD/ChilkatZip2.dll
Resource
win11-20260130-en
Behavioral task
behavioral17
Sample
SAAZOD/ClearLogs.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral18
Sample
SAAZOD/ClearLogs.exe
Resource
win11-20260130-en
Behavioral task
behavioral19
Sample
SAAZOD/DMPHelpDesk.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral20
Sample
SAAZOD/DMPHelpDesk.exe
Resource
win11-20260130-en
Behavioral task
behavioral21
Sample
SAAZOD/SAAZDPMACTL.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral22
Sample
SAAZOD/SAAZDPMACTL.exe
Resource
win11-20260130-en
Behavioral task
behavioral23
Sample
SAAZOD/SAAZDefaultJobExe.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral24
Sample
SAAZOD/SAAZDefaultJobExe.exe
Resource
win11-20260130-en
Behavioral task
behavioral25
Sample
SAAZOD/SAAZJobDownload.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral26
Sample
SAAZOD/SAAZJobDownload.exe
Resource
win11-20260130-en
Behavioral task
behavioral27
Sample
SAAZOD/SAAZKill.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral28
Sample
SAAZOD/SAAZKill.exe
Resource
win11-20260130-en
Behavioral task
behavioral29
Sample
SAAZOD/SAAZRemoteSupport.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral30
Sample
SAAZOD/SAAZRemoteSupport.exe
Resource
win11-20260130-en
Behavioral task
behavioral31
Sample
SAAZOD/SAAZScheduler.exe
Resource
win10v2004-20260130-en
Behavioral task
behavioral32
Sample
SAAZOD/SAAZScheduler.exe
Resource
win11-20260130-en
General
- Target SAAZOD/SAAZKill.exe
- Size 50KB
- Sample260424-plnpdaat7p
- SHA256 1a4d115b0a39e69dbb40c63deeff760c9dfb9261921c6a5537b71730616bd986
- MD5 1bb590432e3815ac719f60499c46eba9
- SHA1 f383708c888adaa43ced5585446ffbec9abfc020
- SHA512 b5639ef906b5c467e130db98ef814d90e3dc00a5d596d3ece1fabc252789cfc5785f86e9674c6ce87330f25f2482470432cb0d549dd5b4a027dd326387d18c7b
- SSDEEP 384:67ra7+owxC8nAPhxwr5Pt+yg2Ze99R+0WtBfMIYi4z8jl+rSTELxy8RbmL4nNyJQ:yaaowYZ2j+6Yjw0WtBfdYiFu6O5AL0
- TLSH T1F2337D6359D40827DC468A70A4F48A23AE3F37131F60C0D7E384955A6F607D67E3E7AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SAAZKill.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4380 SAAZKill.exe