AZORult

AZORult is a Trojan downloader and spyware combination that can collect information from your computer, as well as enable other attacks by downloading and installing independent threats. Different threat actors are leveraging AZORult in campaigns that are using either spam e-mails or exploit kits for distribution. Let your anti-malware utilities block and remove AZORult automatically and take proper steps for re-securing any data on your computer, such as passwords.

A Spyware with Its Hands in Every Pie

While most threats specialize in very particular 'genres' of attacks, some are enablers of others, and a minority of those might include both payloads for accomplishing specific goals along with installing threats with more features. As a representative of that last category, malware analysts are highlighting AZORult, which is receiving in-depth development and updates as of mid-2018 and is involved in the spread of both file-locker Trojans and spyware. Besides these details, AZORult also includes some default, data-grabbing features unto itself.

Some of the past scenarios utilizing AZORult include campaigns by the Cthonic Banking Trojan (which is an update of the infamous Keylogger Zeus), along with theHermes Ransomware, by separate threat actors. In both instances, AZORult acts as the 'delivery' aspect of the attack and drops the second threat after accomplishing the rest of its payload. Without any consideration for the variable threatening software that it may drop, malware experts are confirming the following functions for the last version of AZORult:

• AZORult may collect the PC's Web-browsing history as it relates to different browsers, with the exceptions of Internet Explorer and Edge.
• AZORult may compromise the credentials of any cryptocurrency accounts, such as Bitcoin wallets, allowing criminals to take the associated money.
• Besides its spyware functionality, AZORult also is a working Trojan downloader and may download, install and run other threats, based on commands that its remote attacker sends via the admin panel.

AZORult also provides general system status reports and may use proxies, when appropriate.

The Trojan behind the Password

Two of the infection strategies for disseminating AZORult include EKs or exploit kits that compromise website traffic, as well as more traditional, spam e-mail attacks. The latter method may pretend that the AZORult's installer is a work-related document, such as a resume. Some of the last attacks that malware researchers took note of included an additional layer of password protection on the attachments, with the e-mail providing the password code in its body; this unusual formatting choice could be the threat actor's attempt at obscuring the unsafe contents from any security software.

Although threats that it downloads could lock and ransom your files, or conduct other attacks, AZORult is a not-insignificant threat to the PC, by itself. Most cryptocurrency wallets should be presumed compromised from AZORult infections, along with passwords and similar, confidential credentials related to online accounts. Having your anti-malware product uninstall AZORult at the first opportunity is the most appropriate defense against this threat, which, like almost all spyware, suppresses most of the visible symptoms of its presence.

Whether it uses in-browser scripts or a text document's macro for installing itself, AZORult is one of many threats that take advantage of careless security practices from the web surfers that it attacks. Ironically, some aspects of its utilization, such as dropping a file-locking Trojan after collecting anything of any value, may seem self-contradicting, but that caveat is of little comfort to anyone cleaning up an AZORult infection.

Technical Details