azov | 19a6425837d40e6eae879518b0dc1a8a432445b26f43581def6112a9daaa0bbe

General

Target
2026-09-11_26ef708edb2a8fe43ae475c2a0beaef4_hijackloader_icedid_njrat_ryuk
Size 4.3MB
Sample260911-nybpxavyby
SHA256 19a6425837d40e6eae879518b0dc1a8a432445b26f43581def6112a9daaa0bbe
MD5 26ef708edb2a8fe43ae475c2a0beaef4
SHA1 11288a1438f0be3e5ac05eb47f73307051495cfb
SHA512 dcc50991ea4a2e11cf58765ff21128c4c596b32d5500be0371d11d800a8ba8206ea97ec223a6ec92dec22d90370a8524fa5142f16661859c9d1d0ea16bb088a8
SSDEEP 49152:SJMBgF7Si3n6U3XAL8Njmbb/Gedc+KokvY0n/sHQ4VD//IOSArTpYDOJj40NsHyT:/HH3/Ged+UsiC96HuI
TLSH
T138266C03F2E941D8F0AAE2789B765732EE72BC568B30A5DF025036151E76EE05B3C761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-11_26ef708edb2a8fe43ae475c2a0beaef4_hijackloader_icedid_njrat_ryuk
- Size 4.3MB
- SHA256 19a6425837d40e6eae879518b0dc1a8a432445b26f43581def6112a9daaa0bbe
- MD5 26ef708edb2a8fe43ae475c2a0beaef4
- SHA1 11288a1438f0be3e5ac05eb47f73307051495cfb
- SHA512 dcc50991ea4a2e11cf58765ff21128c4c596b32d5500be0371d11d800a8ba8206ea97ec223a6ec92dec22d90370a8524fa5142f16661859c9d1d0ea16bb088a8
- SSDEEP 49152:SJMBgF7Si3n6U3XAL8Njmbb/Gedc+KokvY0n/sHQ4VD//IOSArTpYDOJj40NsHyT:/HH3/Ged+UsiC96HuI
- TLSH
  T138266C03F2E941D8F0AAE2789B765732EE72BC568B30A5DF025036151E76EE05B3C761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery azov persistence privilege_escalation ransomware spyware stealer wiper
- Family: Azov
  A wiper seeking only damage, first seen in 2022.
  ransomware wiper azov
- Renames multiple (10470) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1