(Kaspersky) The AZORult Trojan is one of the most commonly bought and sold stealers in Russian forums. Despite the relatively high price tag ($100), buyers like AZORult for its broad functionality (for example, the use of .bit domains as C&C servers to ensure owner anonymity and to make it difficult to block the C&C server), as well as its high performance. Many comment leavers recommend it. AZORult is a Trojan stealer that collects various data on infected computers and sends it to the C&C server, including browser history, login credentials, cookies, files from folders as specified by the C&C server (for example, all TXT files from the Desktop folder), cryptowallet files, etc.; the malware can also be used as a loader to download other malware. Kaspersky Lab products detect the stealer as Trojan-PSW.Win32.Azorult. Our statistics show that since the start of 2019, users in Russia and India are the most targeted.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|---|
| 46.183.220.70:80 | 2023-10-13 |
| 185.29.11.60:80 | 2023-10-13 |
| 198.98.54.161:80 | 2023-08-30 |
| 185.29.8.42:80 | 2023-08-07 |
| 194.31.98.112:80 | 2022-06-02 |
| 85.202.169.121:80 | 2022-03-14 |
| 66.151.174.10:443 | 2021-08-05 |
| Domain | Timestamp |
|---|---|
| www.mixz.shop | 2023-10-10 |
| oldhorse.info | 2023-07-02 |
| icanda.ac.ug | 2023-04-15 |
| transal.ac.ug | 2023-04-15 |
| suspam.com | 2021-08-05 |
| URL | Timestamp |
|---|---|
| http://hoswell.shop/RUT341/index.php | 2023-11-30 |
| http://gqc4.shop/C4341/index.php | 2023-11-26 |
| http://51.15.208.114/3EF47870-330C-447F-822F-7397E2DA4ED6/index.php | 2023-11-25 |
| http://d4gj.shop/GJ341/index.php | 2023-11-24 |
| http://blazh.shop/ZH341/index.php | 2023-11-23 |
| http://185.29.10.12/2023/Panel/index.php | 2023-11-25 |
| http://51.15.208.114/3EF47870-330C-447F-822F-7397E2DA4ED6/index.php | 2023-11-07 |
| http://buuuzar.ru/index.php | 2023-11-25 |
| http://pois.in:8010/_az/ | 2023-10-30 |
| http://serviceadminwebmailboxupgrace.biz.wf/index.php | 2023-10-30 |
Tool: AZORult
Names: AZORult, PuffStealer, Rultazo
Description: (Kaspersky) The AZORult Trojan is one of the most commonly bought and sold stealers in Russian forums. Despite the relatively high price tag ($100), buyers like AZORult for its broad functionality (for example, the use of .bit domains as C&C servers to ensure owner anonymity and to make it difficult to block the C&C server), as well as its high performance. Many comment leavers recommend it. AZORult is a Trojan stealer that collects various data on infected computers and sends it to the C&C server, including browser history, login credentials, cookies, files from folders as specified by the C&C server (for example, all TXT files from the Desktop folder), cryptowallet files, etc.; the malware can also be used as a loader to download other malware. Kaspersky Lab products detect the stealer as Trojan-PSW.Win32.Azorult. Our statistics show that since the start of 2019, users in Russia and India are the most targeted.
Category: Malware
Type: Info stealer, Credential stealer, Downloader
Information: https://securelist.com/azorult-analysis-history/89922/
Information: https://threatvector.cylance.com/en_us/home/threat-spotlight-analyzing-azorult-infostealer-malware.html
Information: https://blog.minerva-labs.com/puffstealer-evasion-in-a-cloak-of-multiple-layers
Information: https://blog.minerva-labs.com/azorult-now-as-a-signed-google-update
Information: https://www.blueliv.com/blog-news/research/azorult-crydbrox-stops-sells-malware-credential-stealer/
Information: https://research.checkpoint.com/the-emergence-of-the-new-azorult-3-3/
Mitre-attack: https://attack.mitre.org/software/S0344/
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult
Last-card-change: 2020-05-13
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1134.002 ACCESS TOKEN MANIPULATION : CREATE PROCESS WITH TOKEN azorult can call wtsqueryusertoken and createprocessasuser to start a new process with local system privileges. T1055.012 PROCESS INJECTION : PROCESS HOLLOWING azorult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the new process and resume new process execution. | T1134.002 ACCESS TOKEN MANIPULATION : CREATE PROCESS WITH TOKEN azorult can call wtsqueryusertoken and createprocessasuser to start a new process with local system privileges. T1140 DEOBFUSCATE/DECODE FILES OR INFORMATION azorult uses an xor key to decrypt content and uses base64 to decode the c2 address. T1055.012 PROCESS INJECTION : PROCESS HOLLOWING azorult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the new process and resume new process execution. | T1555.003 CREDENTIALS FROM PASSWORD STORES : CREDENTIALS FROM WEB BROWSERS azorult can steal credentials from the victim's browser. T1552.001 UNSECURED CREDENTIALS : CREDENTIALS IN FILES azorult can steal credentials in files belonging to common software such as skype, telegram, and steam. | T1083 FILE AND DIRECTORY DISCOVERY azorult can recursively search for files in folders and collects files from the desktop with certain extensions. T1057 PROCESS DISCOVERY azorult can collect a list of running processes by calling createtoolhelp32snapshot. T1012 QUERY REGISTRY azorult can check for installed software on the system under the registry key software\microsoft\windows\currentversion\uninstall. T1082 SYSTEM INFORMATION DISCOVERY azorult can collect the machine information, system architecture, the os version, computer name, windows product name, the number of cpu cores, video card information, and the system language. T1016 SYSTEM NETWORK CONFIGURATION DISCOVERY azorult can collect host ip information from the victim’s machine. | T1105 INGRESS TOOL TRANSFER azorult can download and execute additional files. azorult has also downloaded a ransomware payload called hermes. |