azov | 7c07aa94a37b55f2a3be98b74825f7fa8cb0ed7dc60a6e82918c439a319c47d2

General

Target
2026-08-29_483e8a62198bc7c92cc2a29890cd4b8a_cobalt-strike_hijackloader_icedid_njrat_satacom_stealc
Size 3.6MB
Sample260829-mxvkysyblb
SHA256 7c07aa94a37b55f2a3be98b74825f7fa8cb0ed7dc60a6e82918c439a319c47d2
MD5 483e8a62198bc7c92cc2a29890cd4b8a
SHA1 b4363065d4038cc8a93a520b7cf4df1eceed0919
SHA512 92085166744347ed65d9217d2e642b1e674df640111b9b0205d81c93a6dd17230c040e53c51fb572261eaba51454fec4bd98fdda1783f0eb117d34d8ab1a171b
SSDEEP 49152:G/vmHGcnO2EvU/bMvo/SHEif5YL8NnjSGjNCWTPp8N7s8SJG0I8ySzm0:yTvUko/Szbj0I8NiPIm
TLSH
T1180618ADA6DE00C6C070A4F4CD065795E2F2F864833149CB15E81A1FAE7FEED4E39664
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-29_483e8a62198bc7c92cc2a29890cd4b8a_cobalt-strike_hijackloader_icedid_njrat_satacom_stealc
- Size 3.6MB
- SHA256 7c07aa94a37b55f2a3be98b74825f7fa8cb0ed7dc60a6e82918c439a319c47d2
- MD5 483e8a62198bc7c92cc2a29890cd4b8a
- SHA1 b4363065d4038cc8a93a520b7cf4df1eceed0919
- SHA512 92085166744347ed65d9217d2e642b1e674df640111b9b0205d81c93a6dd17230c040e53c51fb572261eaba51454fec4bd98fdda1783f0eb117d34d8ab1a171b
- SSDEEP 49152:G/vmHGcnO2EvU/bMvo/SHEif5YL8NnjSGjNCWTPp8N7s8SJG0I8ySzm0:yTvUko/Szbj0I8NiPIm
- TLSH
  T1180618ADA6DE00C6C070A4F4CD065795E2F2F864833149CB15E81A1FAE7FEED4E39664
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery azov persistence privilege_escalation ransomware spyware stealer wiper
- Family: Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Renames multiple (10363) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2