AZORult

AZORult Description

'AZORult' is an Infostealer Trojan that was added to AV databases in 2016 and received a major update in July 2018. The AZORult Infostealer Trojan includes downloader capabilities and may be used as first-stage and second-stage malware. The AZORult threat is introduced to computers via exploit kits primarily, but there are plenty of cases where AZORult was installed by users opening a corrupted Microsoft Word file received via spam emails. The AZORult dropper module was reported to be part of a campaign that delivered the Hermes Ransomware to users. The creators of AZORult have used forums on the Dark Web to promote their product and invite other threat actors to buy AZORult for their campaigns. The AZORult malware was promoted to include the following features:

  • AZORult can copy browsing history from Internet clients based on Chromium and Mozilla Firefox.
  • AZORult can hijack cryptocurrency wallets like Exodus, Jaxx, Mist, Ethereum, Electrum and Electrum-LTC.
  • The new AZORult loader is said to be customizable and detect certain objects on the infected host, which can be uploaded to the 'Command and Control' server.
  • AZORult can connect to the Internet through proxies installed on the infected host.

The AZORult Trojan can be used to collect information from users and drop more malware on the compromised devices. The version 2 of AZORult make it one of the most versatile cyber threats of 2018. The AZORult Trojan is observed to encrypt the collected information using an XOR algorithm and a 3-byte key. AZORult can copy cookies from the browser and potentially allow cloned browser sessions. The AZORult downloader module might enable threat actors to use a single PC and spread over a company network. The AZORult Trojan is deemed as an advanced threat that should be countered with multi-level defenses and reliable access policies. PC users that may be infected with AZORult may notice questionable process names in the task manager and unusual network communications. It is recommended to remove AZORult using a reputable anti-malware suite. Detection names associated with AZORult include:

BehavesLike.Win32.PWSZbot.dh
HW32.Packed.71D8
Heur.Win32.VBKrypt.3!O
Ransom.Win32.HERMS.SMTH
Spyware.Infostealer.Azorult
TROJ_GEN.R020H09GO18
Trojan ( 00538c421 )
Trojan-PSW.Win32.Coins.fjd
Trojan.PonyStealer.3
Trojan/Win32.Hermesran.R232399
Trojan:Win32/Skeeyah.A!rfn
Win32.Trojan-qqpass.Qqrob.Szvd
a variant of Win32/Injector.DZKP


This Week In Malware Ep 11: AZORult Trojan Using Fake ProtonVPN Installer to Trick Computer Users

Technical Information

File System Details

AZORult creates the following file(s):
# File Name Size MD5 Detection Count
1 %ALLUSERSPROFILE%\ixrfub.exe\ixrfub.exe 321,024 ed0b1344ae61ca6e719ea4b00d62353d 92
2 c:\users\alan.k\desktop\desktop ii\esgtools\esg tools\tools\info (2)\info\binances\crypt\binances.exe 380,416 6439131def75c6ef73cb43467c9444ff 9
3 69ef96c982cd06ab342adbc051adb990 129,536 69ef96c982cd06ab342adbc051adb990 2
4 file.exe 538,952 ab9330711166d04bd3814aa5a4873357 1
5 9994f688218d3c00c68937f2295fe6cd 284,672 9994f688218d3c00c68937f2295fe6cd 0

Registry Details

AZORult creates the following registry entry or registry entries:
Regexp file mask
%appdata%\4eddrftbgvfc.exe
%appdata%\cdegef.exe
%appdata%\revdd.exe
%appdata%\rtfvdc.exe
%appdata%\uyntbrvfec.exe
%appdata%\vgrfdcsx.exe
%windir%\wotsuper.reg
Registry key
Software\Margin Trade
SYSTEM\ControlSet001\services\BYTEDOWNLOAD PROTECT SERVICE
SYSTEM\ControlSet002\services\BYTEDOWNLOAD PROTECT SERVICE
SYSTEM\CurrentControlSet\services\BYTEDOWNLOAD PROTECT SERVICE
Uninstaller
LetsSee! 2.15
WOTSUPER 2.1
{185623589-5865-4F66-B722-EE1C7FDA0836}_is1
Directory
%APPDATA%\Margin Trade
%PROGRAMFILES%\Dada\softsinn
%PROGRAMFILES%\Issue\softsinn
%PROGRAMFILES%\karim\softsinn
%PROGRAMFILES%\LetsSee!
%PROGRAMFILES%\LetsSeeI
%PROGRAMFILES%\Margin Trade
%PROGRAMFILES%\rundll\softsinn
%PROGRAMFILES%\wotsuper
%PROGRAMFILES(x86)%\Dada\softsinn
%PROGRAMFILES(x86)%\Issue\softsinn
%PROGRAMFILES(x86)%\karim\softsinn
%PROGRAMFILES(x86)%\LetsSee!
%PROGRAMFILES(x86)%\LetsSeeI
%PROGRAMFILES(x86)%\Lov\softsinn
%PROGRAMFILES(x86)%\Margin Trade
%PROGRAMFILES(x86)%\rundll\softsinn
%PROGRAMFILES(x86)%\wotsuper
%WINDIR%\System32\softsinn
%WINDIR%\SysWOW64\softsinn

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.