AZORult

AZORult Description

'AZORult' is an Infostealer Trojan that was added to AV databases in 2016 and received a major update in July 2018. The AZORult Infostealer Trojan includes downloader capabilities and may be used as first-stage and second-stage malware. The AZORult threat is introduced to computers via exploit kits primarily, but there are plenty of cases where AZORult was installed by users opening a corrupted Microsoft Word file received via spam emails. The AZORult dropper module was reported to be part of a campaign that delivered the Hermes Ransomware to users. The creators of AZORult have used forums on the Dark Web to promote their product and invite other threat actors to buy AZORult for their campaigns. The AZORult malware was promoted to include the following features:

  • AZORult can copy browsing history from Internet clients based on Chromium and Mozilla Firefox.
  • AZORult can hijack cryptocurrency wallets like Exodus, Jaxx, Mist, Ethereum, Electrum and Electrum-LTC.
  • The new AZORult loader is said to be customizable and detect certain objects on the infected host, which can be uploaded to the 'Command and Control' server.
  • AZORult can connect to the Internet through proxies installed on the infected host.

The AZORult Trojan can be used to collect information from users and drop more malware on the compromised devices. The version 2 of AZORult make it one of the most versatile cyber threats of 2018. The AZORult Trojan is observed to encrypt the collected information using an XOR algorithm and a 3-byte key. AZORult can copy cookies from the browser and potentially allow cloned browser sessions. The AZORult downloader module might enable threat actors to use a single PC and spread over a company network. The AZORult Trojan is deemed as an advanced threat that should be countered with multi-level defenses and reliable access policies. PC users that may be infected with AZORult may notice questionable process names in the task manager and unusual network communications. It is recommended to remove AZORult using a reputable anti-malware suite. Detection names associated with AZORult include:

BehavesLike.Win32.PWSZbot.dh
HW32.Packed.71D8
Heur.Win32.VBKrypt.3!O
Ransom.Win32.HERMS.SMTH
Spyware.Infostealer.Azorult
TROJ_GEN.R020H09GO18
Trojan ( 00538c421 )
Trojan-PSW.Win32.Coins.fjd
Trojan.PonyStealer.3
Trojan/Win32.Hermesran.R232399
Trojan:Win32/Skeeyah.A!rfn
Win32.Trojan-qqpass.Qqrob.Szvd
a variant of Win32/Injector.DZKP

Do You Suspect Your Computer May Be Infected with AZORult & Other Threats? Scan Your Computer with SpyHunter

SpyHunter is a powerful malware remediation and protection tool designed to help provide users with in-depth system security analysis, detection and removal of a wide range of threats like AZORult as well as a one-on-one tech support service. Download SpyHunter's FREE Malware Remover*
Free Remover allows you, subject to a 48-hour waiting period, one remediation and removal for results found. Read our EULA, Privacy Policy & Special Discount Terms. See more Free SpyHunter Remover details.

Technical Information

File System Details

AZORult creates the following file(s):
# File Name Size MD5 Detection Count
1 %ALLUSERSPROFILE%\ixrfub.exe\ixrfub.exe 321,024 ed0b1344ae61ca6e719ea4b00d62353d 92
2 c:\users\alan.k\desktop\desktop ii\esgtools\esg tools\tools\info (2)\info\binances\crypt\binances.exe 380,416 6439131def75c6ef73cb43467c9444ff 8
3 file.exe 538,952 ab9330711166d04bd3814aa5a4873357 1
4 9994f688218d3c00c68937f2295fe6cd 284,672 9994f688218d3c00c68937f2295fe6cd 0

Registry Details

AZORult creates the following registry entry or registry entries:
Regexp file mask
%appdata%\4eddrftbgvfc.exe
%appdata%\cdegef.exe
%appdata%\revdd.exe
%appdata%\rtfvdc.exe
%appdata%\uyntbrvfec.exe
%appdata%\vgrfdcsx.exe
%windir%\wotsuper.reg
Registry key
Software\GCleaner
Software\Margin Trade
SOFTWARE\Microsoft\Tracing\Garbage Cleaner_RASAPI32
SOFTWARE\Microsoft\Tracing\Garbage Cleaner_RASMANCS
SYSTEM\ControlSet001\services\BYTEDOWNLOAD PROTECT SERVICE
SYSTEM\ControlSet002\services\BYTEDOWNLOAD PROTECT SERVICE
SYSTEM\CurrentControlSet\services\BYTEDOWNLOAD PROTECT SERVICE
Uninstaller
LetsSee! 2.15
WOTSUPER 2.1
{185623589-5865-4F66-B722-EE1C7FDA0836}_is1
Directory
%ALLUSERSPROFILE%\Garbage Cleaner
%APPDATA%\Margin Trade
%PROGRAMFILES%\Dada\softsinn
%PROGRAMFILES%\Issue\softsinn
%PROGRAMFILES%\karim\softsinn
%PROGRAMFILES%\LetsSee!
%PROGRAMFILES%\LetsSeeI
%PROGRAMFILES%\Margin Trade
%PROGRAMFILES%\rundll\softsinn
%PROGRAMFILES%\wotsuper
%PROGRAMFILES(x86)%\Dada\softsinn
%PROGRAMFILES(x86)%\Issue\softsinn
%PROGRAMFILES(x86)%\karim\softsinn
%PROGRAMFILES(x86)%\LetsSee!
%PROGRAMFILES(x86)%\LetsSeeI
%PROGRAMFILES(x86)%\Lov\softsinn
%PROGRAMFILES(x86)%\Margin Trade
%PROGRAMFILES(x86)%\rundll\softsinn
%PROGRAMFILES(x86)%\wotsuper
%WINDIR%\System32\softsinn
%WINDIR%\SysWOW64\softsinn

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.

By GoldSparrow in Trojans
Translate To: Português
Threat Scorecard
?
The ESL Threat Scorecard is an assessment report that is given to every malware threat that has been collected and analyzed through our Malware Research Center. The ESL Threat Scorecard evaluates and ranks each threat by using several metrics such as trends, incidents and severity over time.

In addition to the effective scoring for each threat, we are able to interpret anonymous geographic data to list the top three countries infected with a particular threat. The data used for the ESL Threat Scorecard is updated daily and displayed based on trends for a 30-day period. The ESL Threat Scorecard is a useful tool for a wide array of computer users from end users seeking a solution to remove a particular threat or security experts pursuing analysis and research data on emerging threats.

Each of the fields listed on the ESL Threat Scorecard, containing a specific value, are as follows:

Ranking: The current ranking of a particular threat among all the other threats found on our malware research database.

Threat Level: The level of threat a particular computer threat could have on an infected computer. The threat level is based on a particular threat's behavior and other risk factors. We rate the threat level as low, medium or high. The different threat levels are discussed in the SpyHunter Risk Assessment Model.

Infected Computer: The number of confirmed and suspected cases of a particular threat detected on infected computers retrieved from diagnostic and scan log reports generated by SpyHunter's Spyware Scanner.

% Change: The daily percent change in the frequency of infected computers of a specific threat. The formula for percent changes results from current trends of a specific threat. An increase in the rankings of a specific threat yields a recalculation of the percentage of its recent gain. When a specific threat's ranking decreases, the percentage rate reflects its recent decline. For a specific threat remaining unchanged, the percent change remains in its current state. The % Change data is calculated and displayed in three different date ranges, in the last 24 hours, 7 days and 30 days. Next to the percentage change is the trend movement a specific malware threat does, either upward or downward, in the rankings. Each level of movement is color coded: a green up-arrow (∧) indicates a rise, a red down-arrow (∨) indicates a decline, and a brown equal symbol (=) indicates no change or plateaued.

Top 3 Countries Infected: Lists the top three countries a particular threat has targeted the most over the past month. This data allows computer users to track the geographic distribution of a particular threat throughout the world.
Ranking: N/A
Threat Level: 8
Infected Computers: 199,632