Troj/Azov-A (file analysis)

The Troj/Azov-A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Troj/Azov-A virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Troj/Azov-A?


File Info:
name: 4774B10D87E7942CEBCE.mlw
path: /opt/CAPEv2/storage/binaries/e76ed6493c0cfee6f19b7d4d9174935de1950d04da535967ae4aeead102db894
crc32: A71D4B6C
md5: 4774b10d87e7942cebcefbc5a2c3ec05
sha1: 801be7cffcbf7aa8a9b8b4ffee4b3b80f3ffdef3
sha256: e76ed6493c0cfee6f19b7d4d9174935de1950d04da535967ae4aeead102db894
sha512: cb572f089fa88f4c8ae4edefa86cc02b0bfad17c67f58581fe59350a962f45298f6161574e5c256ffb638a25ae0673fd9fe45cca2890e09f2302c770a1f97dcc
ssdeep: 49152:dDLiiAZfKiJMuQG2rIV0SkvkDuW5t9xG4KsPq3BOz2QvOkI6xKGKLAoVgbKW2llD:MT5kvc7j9MJ6xPh5w3D7nTsReRR9Wpp2
type: PE32+ executable (console) x86-64, for MS Windows
tlsh: T17686294677F455E5E1B7C2B489B696B1FAB2B8951C34E34F1061821F2F33AB09D2D322
sha3_384: 7a3d4d0a28104aa74df092114d3af3d70450f883c8938128c50282af8dbc8bbe106dff4771ae2e5456285404ff70c056
ep_bytes: e848feffffc82000004c897c24f84883
timestamp: 2015-07-30 12:10:46

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Microsoft Office Document Cache Migration
FileVersion: 16.0.4266.1001
InternalName: cmigrate
LegalTrademarks1: Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2: Windows® is a registered trademark of Microsoft Corporation.
OriginalFilename: cmigrate.exe
ProductName: Microsoft Office 2016
ProductVersion: 16.0.4266.1001
MOSEVersion: BETA
Translation: 0x0000 0x04e4

Troj/Azov-A also known as:

MicroWorld-eScan	Gen:Variant.Lazy.259506
ClamAV	Win.Ransomware.Lazy-9976914-0
FireEye	Gen:Variant.Lazy.259506
ALYac	Gen:Variant.Lazy.259506
Malwarebytes	Ransom.Azov
VIPRE	Gen:Variant.Lazy.259506
K7AntiVirus	Trojan ( 0059aa0b1 )
K7GW	Trojan ( 0059aa0b1 )
Cyren	W64/Ipamor.A
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win64/Filecoder.GG
BitDefender	Gen:Variant.Lazy.259506
Avast	Win64:Trojan-gen
Tencent	Trojan-Ransom.Win64.Blocker.ya
Ad-Aware	Gen:Variant.Lazy.259506
Sophos	Troj/Azov-A
DrWeb	Win32.HLLP.Azov.2
Emsisoft	Gen:Variant.Lazy.259506 (B)
GData	Gen:Variant.Lazy.259506
Jiangmin	Trojan.Blocker.urx
MAX	malware (ai score=87)
Antiy-AVL	GrayWare/Win32.Filecoder.gg
Arcabit	Trojan.Lazy.D3F5B2
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R534216
Acronis	suspicious
Rising	Ransom.Agent!8.6B7 (TFE:2:U9tOTBNOHOO)
Ikarus	Trojan-Ransom.FileCrypter
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W64/Filecoder.GG!tr
AVG	Win64:Trojan-gen

How to remove Troj/Azov-A?

Troj/Azov-A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X