Corona-virus-map.com

Corona-virus-map.com may sound like the domain name of a website that provides statistics about the spread of the Coronavirus (COVID-19), but, in reality, it is the name of a fake application that is being used to deliver the AZORult Trojan to victims worldwide. As you can probably guess, the operators of the AZORult Trojan have decided to take advantage of the panic surrounding the COVID-19 virus, and they have started to spread a fake map application that users might be tempted to download in order to find out more about the Coronavirus statistics in their country or region.

Beware of Shady Applications and Services Related to the Coronavirus

Although most of the recipients of the fake Corona-virus-map.com app received a download link via a phishing email, it is safe to assume that the masterminds behind this malicious campaign will rely on other propagation tricks as well – we advise you to be careful around any tools and programs that are being promoted as utilities that contain data about the spread of the Coronavirus. In fact, it is recommended to avoid such apps altogether, since there are plenty of online services that provide up-to-date COVID-19 information without asking you to download 3rd-party applications.

The Bogus 'Corona-virus-map.com' Application Delivers an Infostealing Trojan

Victims of the fake Corona-virus-map.com application may not notice anything out of the ordinary when the threat is active on their computer, but this is only because the AZORult Trojan will carry out its tasks in the background. The primary goal of this threat is to extract login credentials and other sensitive data that may end up being processed through the infected computer. Previous AZORult campaigns focused on stealing:

• Browser cookies, history, saved logins, and other browser-related data.
• Passwords used by FTP clients, email clients, and social networks.
• Password used by instant messaging applications.

Some variants of the AZORult Trojan were also able to steal separate files from the user's desktop, as well as to take screenshots of their desktop. Needless to say, this is a high-profile threat that may end up causing a lot of problems if it ends up on your computer.

Keep in mind that many cybercriminals are taking advantage of the interest in the Coronavirus topic, and the AZORult Trojan is not the only cyber threat being spread under the disguise of a document or application related to the Coronavirus – the authors of the FormBook malware have also launched a similar campaign.