azov | 37b73993057acf150241713548e3252ca591ab85560e3813420b0693d1b2cae4

General

Target
2026-08-31_fa88a43641e6a39f767241930eb70981_cobalt-strike_hijackloader_icedid
Size 574KB
Sample260901-2xt2rayepc
SHA256 37b73993057acf150241713548e3252ca591ab85560e3813420b0693d1b2cae4
MD5 fa88a43641e6a39f767241930eb70981
SHA1 123ca92e9d6ae8ac3d29833fbe3991ea0f937d5a
SHA512 f440bc65e0d5dccbc93a69aaffd9ac57934726bc258adaa7c539ed7566a01db7ac2a48ee0ec6e0297741fe0e9ae7e7ff2b29a6b68fd805e6f2521def01fd9188
SSDEEP 6144:/jObFf7s9KC031MRmhKGZZpXgohVIIciY4VWKFJY2deILRiBKYXnOOsjLrnvWt:qRf7s9KC0lM+ZfwoTxFeKkg7Lret
TLSH
T11CC41779E6B844D4E6BAB53886638559E222FC09435196CF39687F063F377D0FA7A300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-08-31_fa88a43641e6a39f767241930eb70981_cobalt-strike_hijackloader_icedid
- Size 574KB
- SHA256 37b73993057acf150241713548e3252ca591ab85560e3813420b0693d1b2cae4
- MD5 fa88a43641e6a39f767241930eb70981
- SHA1 123ca92e9d6ae8ac3d29833fbe3991ea0f937d5a
- SHA512 f440bc65e0d5dccbc93a69aaffd9ac57934726bc258adaa7c539ed7566a01db7ac2a48ee0ec6e0297741fe0e9ae7e7ff2b29a6b68fd805e6f2521def01fd9188
- SSDEEP 6144:/jObFf7s9KC031MRmhKGZZpXgohVIIciY4VWKFJY2deILRiBKYXnOOsjLrnvWt:qRf7s9KC0lM+ZfwoTxFeKkg7Lret
- TLSH
  T11CC41779E6B844D4E6BAB53886638559E222FC09435196CF39687F063F377D0FA7A300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery azov persistence privilege_escalation ransomware spyware stealer wiper
- Family: Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Renames multiple (10545) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2