azov | 102ababcb113210b3b7beb9c9b33a4f440183b981111a39fc2373533cc3511c4

General

Target
2026-08-02_e0b64b55ae82dc90ad5d0ee07fab9228_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_satacom
Size 11.9MB
Sample260802-mm5cea1bnd
SHA256 102ababcb113210b3b7beb9c9b33a4f440183b981111a39fc2373533cc3511c4
MD5 e0b64b55ae82dc90ad5d0ee07fab9228
SHA1 19a6bc2f2f982f4b06116725160f44e22cff6bd9
SHA512 3343042f8d5868e699c6c55f8c9255edc0552e40c689813c1055bc0dcd27823f89e56277ea9f4d9e837299fa473e0611c9c876e248adb84ed4a4de63921d4b68
SSDEEP 98304:/h+p1yco1pKsPW3sSJZs9gajjXMgUlG8dr87GweHa7zlvKOZ5zv7gLdW:JDr1I2Wcq6jj7UlG8drCeqBvKCzcLA
TLSH
T15BC65C1B62EC01DCD0FAD1B9C91B4903E675745A037183DF179086AA6FAB6F09E7EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-02_e0b64b55ae82dc90ad5d0ee07fab9228_akira_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_satacom
- Size 11.9MB
- SHA256 102ababcb113210b3b7beb9c9b33a4f440183b981111a39fc2373533cc3511c4
- MD5 e0b64b55ae82dc90ad5d0ee07fab9228
- SHA1 19a6bc2f2f982f4b06116725160f44e22cff6bd9
- SHA512 3343042f8d5868e699c6c55f8c9255edc0552e40c689813c1055bc0dcd27823f89e56277ea9f4d9e837299fa473e0611c9c876e248adb84ed4a4de63921d4b68
- SSDEEP 98304:/h+p1yco1pKsPW3sSJZs9gajjXMgUlG8dr87GweHa7zlvKOZ5zv7gLdW:JDr1I2Wcq6jj7UlG8drCeqBvKCzcLA
- TLSH
  T15BC65C1B62EC01DCD0FAD1B9C91B4903E675745A037183DF179086AA6FAB6F09E7EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery azov persistence privilege_escalation ransomware spyware stealer wiper
- Family: Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Renames multiple (9971) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2