SYMBOLCOMMON_NAMEaka. SYNONYMS
win.azorult (Back to overview)

Azorult

aka: PuffStealer, Rultazo

Actor(s): The Gorgon Group

VTCollection     URLhaus        

AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.

References
2024-09-04 ⋅ ANY.RUN ⋅ ANY.RUN, Mostafa ElSheimy
AZORult Malware: Technical Analysis
Azorult
2024-01-12 ⋅ cyble ⋅ Cyble
Sneaky Azorult Back in Action and Goes Undetected
Azorult
2023-01-30 ⋅ Checkpoint ⋅ Arie Olshtein
Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware
Agent Tesla Azorult Buer Cerber Cobalt Strike Emotet Formbook HawkEye Keylogger Loki Password Stealer (PWS) Maze NetWire RC Remcos REvil TrickBot
2022-08-25 ⋅ splunk ⋅ Splunk Threat Research Team
AppLocker Rules as Defense Evasion: Complete Analysis
Azorult
2022-08-08 ⋅ Medium CSIS Techblog ⋅ Benoît Ancel
An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure
Riltok magecart Anubis Azorult BetaBot Buer CoalaBot CryptBot DiamondFox DreamBot GCleaner ISFB Loki Password Stealer (PWS) MedusaLocker MeguminTrojan Nemty PsiX RedLine Stealer SmokeLoader STOP TinyNuke Vidar Zloader
2022-08-02 ⋅ Recorded Future ⋅ Insikt Group
Initial Access Brokers Are Key to Rise in Ransomware Attacks
Azorult BlackMatter Conti Mars Stealer Raccoon RedLine Stealer Taurus Stealer Vidar
2022-07-13 ⋅ KELA ⋅ KELA Cyber Intelligence Center
The Next Generation of Info Stealers
Arkei Stealer Azorult BlackGuard Eternity Stealer Ginzo Stealer Mars Stealer MetaStealer Raccoon RedLine Stealer Vidar
2022-05-10 ⋅ Checkpoint ⋅ Checkpoint
Info-stealer Campaign targets German Car Dealerships and Manufacturers
Azorult BitRAT Raccoon
2021-12-02 ⋅ Cisco ⋅ Tiago Pereira
Magnat campaigns use malvertising to deliver information stealer, backdoor and malicious Chrome extension
Azorult RedLine Stealer
2021-11-29 ⋅ Trend Micro ⋅ Jaromír Hořejší
Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites
AsyncRAT Azorult Nanocore RAT NjRAT RedLine Stealer Remcos
2021-10-06 ⋅ zimperium ⋅ Jordan Herman
Malware Distribution with Mana Tools
Agent Tesla Azorult
2021-09-08 ⋅ RiskIQ ⋅ Jennifer Grob
Bulletproof Hosting Services: Investigating Flowspec
Azorult Glupteba
2021-09-04 ⋅ cocomelonc ⋅ cocomelonc
AV engines evasion for C++ simple malware: part 1
4h_rat Azorult BADCALL BadNews BazarBackdoor Cardinal RAT
2021-08-18 ⋅ AhnLab ⋅ ASEC Analysis Team
Infostealer Malware Azorult Being Distributed Through Spam Mails
Azorult
2021-07-12 ⋅ IBM ⋅ Claire Zaboeva, Dan Dash, Melissa Frydrych
RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation
404 Keylogger Agent Tesla AsyncRAT Ave Maria Azorult BitRAT Formbook HawkEye Keylogger Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Quasar RAT RedLine Stealer Remcos
2021-07-12 ⋅ Cipher Tech Solutions ⋅ Claire Zaboeva, Dan Dash, Melissa Frydrych
RoboSki and Global Recovery: Automation to Combat Evolving Obfuscation
404 Keylogger Agent Tesla AsyncRAT Ave Maria Azorult BitRAT Formbook HawkEye Keylogger Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Quasar RAT RedLine Stealer Remcos
2021-04-07 ⋅ F5 ⋅ Aditya K. Sood
Dissecting the Design and Vulnerabilities in Azorult C&C Panels
Azorult
2021-02-15 ⋅ Medium s2wlab ⋅ Sojun Ryu
Operation SyncTrek
AbaddonPOS Azorult Clop DoppelDridex DoppelPaymer Dridex PwndLocker
2021-02-06 ⋅ Medium mariohenkel ⋅ Mario Henkel
Decrypting AzoRult traffic for fun and profit
Azorult
2021-02-03 ⋅ Medium s2wlab ⋅ Hyunmin Suh, Minjei Cho
W1 Feb| EN | Story of the week: Stealers on the Darkweb
Azorult Raccoon Vidar
2021-01-28 ⋅ Youtube (Virus Bulletin) ⋅ Benoît Ancel
The Bagsu banker case
Azorult DreamBot Emotet Pony TrickBot ZeusAction
2021-01-22 ⋅ Thomas Barabosch
The malware analyst’s guide to PE timestamps
Azorult Gozi IcedID ISFB LOLSnif SUNBURST TEARDROP
2021-01-09 ⋅ Marco Ramilli's Blog ⋅ Marco Ramilli
Command and Control Traffic Patterns
ostap LaZagne Agent Tesla Azorult Buer Cobalt Strike DanaBot DarkComet Dridex Emotet Formbook IcedID ISFB NetWire RC PlugX Quasar RAT SmokeLoader TrickBot
2020-12-14 ⋅ Blueliv ⋅ Alberto Marín, Blueliv Labs Team, Carlos Rubio
Using Qiling Framework to Unpack TA505 packed samples
AndroMut Azorult Silence TinyMet
2020-12-02 ⋅ DomainTools ⋅ Joe Slowik
Identifying Network Infrastructure Related to a World Health Organization Spoofing Campaign
Azorult Glupteba
2020-11-18 ⋅ VMRay ⋅ Mateusz Lukaszewski, Pascal Brackmann, VMRay Labs Team
Malware Analysis Spotlight: AZORult Delivered by GuLoader
Azorult CloudEyE
2020-09-29 ⋅ Zscaler ⋅ Sahil Antil, Sudeep Singh
Targeted Attacks on Oil and Gas Supply Chain Industries in the Middle East
Azorult
2020-09-02 ⋅ Palo Alto Networks Unit 42 ⋅ Janos Szurdi, Zhanhao Chen
Cybersquatting: Attackers Mimicking Domains of Major Brands Including Facebook, Apple, Amazon and Netflix to Scam Consumers
Azorult
2020-09-01 ⋅ nviso ⋅ Bart Parys, Didier Stevens, Dries Boone, Maxime Thiebaut, Michel Coene
Epic Manchego – atypical maldoc delivery brings flurry of infostealers
Azorult NjRAT
2020-07-30 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q2 2020
AdWind Agent Tesla Arkei Stealer AsyncRAT Ave Maria Azorult DanaBot Emotet IcedID ISFB KPOT Stealer Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Pony Raccoon RedLine Stealer Remcos Zloader
2020-06-11 ⋅ Talos Intelligence ⋅ Joe Marshall, Kendall McKay
Tor2Mine is up to their old tricks — and adds a few new ones
Azorult Remcos
2020-05-21 ⋅ Malwarebytes ⋅ Malwarebytes Labs
Cybercrime tactics and techniques
Ave Maria Azorult DanaBot Loki Password Stealer (PWS) NetWire RC
2020-04-29 ⋅ FR3D.HK ⋅ Fred HK
Gazorp - Thieving from thieves
Azorult
2020-04-15 ⋅ Zscaler ⋅ Sudeep Singh
Multistage FreeDom loader used in Aggah Campaign to spread Nanocore and AZORult
Azorult Nanocore RAT
2020-04-13 ⋅ Blackberry ⋅ Masaki Kasuya, Tatsuya Hasegawa
Threat Spotlight: Gootkit Banking Trojan
Azorult GootKit
2020-04-02 ⋅ Cisco Talos ⋅ Vanja Svajcer
AZORult brings friends to the party
Azorult Remcos
2020-04-01 ⋅ Cisco ⋅ Andrea Kaiser, Shyam Sundar Ramaswami
Navigating Cybersecurity During a Pandemic: Latest Malware and Threat Actors
Azorult CloudEyE Formbook KPOT Stealer Metamorfo Nanocore RAT NetWire RC TrickBot
2020-03-26 ⋅ Max Kersten's Blog ⋅ Max Kersten
Azorult loader stages
Azorult
2020-03-26 ⋅ Telekom ⋅ Thomas Barabosch
TA505's Box of Chocolate - On Hidden Gems packed with the TA505 Packer
Amadey Azorult Clop FlawedGrace Get2 SDBbot Silence TinyMet TA505
2020-02-26 ⋅ KELA ⋅ Leon Kurolapnik, Raveed Laeb
What’s Dead May Never Die: AZORult Infostealer Decommissioned Again
Azorult
2020-02-21 ⋅ KELA ⋅ Raveed Laeb
Exploring the Genesis Supply Chain for Fun and Profit: Part 1 – Misadventures in GUIDology
Azorult
2020-02-19 ⋅ Team Cymru ⋅ Team Cymru
Azorult – what we see using our own tools
Azorult
2020-02-12 ⋅ Twitter (@DrStache_) ⋅ DrStache
Tweet on ManaBotnet
Azorult
2020-02-06 ⋅ Prevailion ⋅ Danny Adamitis
The Triune Threat: MasterMana Returns
Azorult Loki Password Stealer (PWS)
2020-02-05 ⋅ Cybereason ⋅ Assaf Dahan, Lior Rochberger
The Hole in the Bucket: Attackers Abuse Bitbucket to Deliver an Arsenal of Malware
Amadey Azorult Predator The Thief STOP Vidar
2020-02-03 ⋅ SANS ISC ⋅ Jan Kopriva
Analysis of a triple-encrypted AZORult downloader
Azorult
2020-01-27 ⋅ Yoroi ⋅ Luca Mella, Luigi Martire
Aggah: How to run a botnet without renting a Server (for more than a year)
LokiBot Azorult
2020-01-19 ⋅ 360 ⋅ kate
BayWorld event, Cyber Attack Against Foreign Trade Industry
Azorult Formbook Nanocore RAT Revenge RAT
2019-09-26 ⋅ Proofpoint ⋅ Bryan Campbell, Jeremy Hedges, Proofpoint Threat Insight Team
New WhiteShadow downloader uses Microsoft SQL to retrieve malware
WhiteShadow Agent Tesla Azorult Crimson RAT Formbook Nanocore RAT NetWire RC NjRAT Remcos
2019-09-24 ⋅ Yoroi ⋅ Antonio Farina, Luca Mella
APT or not APT? What's Behind the Aggah Campaign
Azorult
2019-08-10 ⋅ Check Point ⋅ Omer Gull
SELECT code_execution FROM * USING SQLite;
Azorult Loki Password Stealer (PWS) Pony
2019-07-11 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Recent AZORult activity
Azorult
2019-06-04 ⋅ Cylance ⋅ Cylance Threat Research Team
Threat Spotlight: Analyzing AZORult Infostealer Malware
Azorult
2019-03-22 ⋅ Kaspersky Labs ⋅ Alexander Eremin
AZORult++: Rewriting history
Azorult
2019-02-07 ⋅ Blueliv ⋅ Blueliv Labs Team
Sales of AZORult grind to an AZOR-halt
Azorult
2019-01-28 ⋅ Minerva Labs ⋅ Asaf Aprozper, Gal Bitensky
AZORult: Now, as A Signed “Google Update”
Azorult
2018-10-17 ⋅ Check Point ⋅ Israel Gubi
The Emergence of the New Azorult 3.3
Azorult
2018-08-18 ⋅ Bleeping Computer ⋅ Vishal Thakur
AZORult Trojan Serving Aurora Ransomware by MalActor Oktropys
Aurora Azorult
2018-07-30 ⋅ Proofpoint ⋅ Proofpoint Staff
New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign
Azorult Hermes
2018-05-17 ⋅ Minerva Labs ⋅ Gal Bitensky
Analyzing an AZORult Attack – Evasion in a Cloak of Multiple Layers
Azorult
2017-11-12 ⋅ MalwareBreakdown
Seamless Campaign Delivers Ramnit via RIG EK at 188.225.82.158. Follow-up Malware is AZORult Stealer.
Azorult
2017-07-24 ⋅ Malware Breakdown ⋅ Malware Breakdown
The Seamless Campaign Drops Ramnit. Follow-up Malware: AZORult Stealer, Smoke Loader, etc.
Azorult
2017-07-24 ⋅ Vitali Kremez Blog ⋅ Vitali Kremez
Let's Learn: Reversing Credential and Payment Card Information Stealer 'AZORult V2'
Azorult
2016-07-26 ⋅ Proofpoint ⋅ Proofpoint
Threat Actors Using Legitimate PayPal Accounts To Distribute Chthonic Banking Trojan
Azorult Chthonic
Yara Rules
[TLP:WHITE] win_azorult_auto (20260917 | Detects win.azorult.)
rule win_azorult_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.azorult."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 56 e8???????? 59 ff05???????? 8b75ec 56 }
            // n = 6, score = 200
            //   56                   | push                esi
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   ff05????????         |                     
            //   8b75ec               | mov                 esi, dword ptr [ebp - 0x14]
            //   56                   | push                esi

        $sequence_1 = { 234df8 8b703c 337024 337010 33701c d1c6 89701c }
            // n = 7, score = 200
            //   234df8               | and                 ecx, dword ptr [ebp - 8]
            //   8b703c               | mov                 esi, dword ptr [eax + 0x3c]
            //   337024               | xor                 esi, dword ptr [eax + 0x24]
            //   337010               | xor                 esi, dword ptr [eax + 0x10]
            //   33701c               | xor                 esi, dword ptr [eax + 0x1c]
            //   d1c6                 | rol                 esi, 1
            //   89701c               | mov                 dword ptr [eax + 0x1c], esi

        $sequence_2 = { ff15???????? 8d8560faffff 50 8d45d0 50 68???????? 8d85b0fdffff }
            // n = 7, score = 200
            //   ff15????????         |                     
            //   8d8560faffff         | lea                 eax, [ebp - 0x5a0]
            //   50                   | push                eax
            //   8d45d0               | lea                 eax, [ebp - 0x30]
            //   50                   | push                eax
            //   68????????           |                     
            //   8d85b0fdffff         | lea                 eax, [ebp - 0x250]

        $sequence_3 = { 6685db 7504 8bc1 eb40 0fb701 56 6685c0 }
            // n = 7, score = 200
            //   6685db               | test                bx, bx
            //   7504                 | jne                 6
            //   8bc1                 | mov                 eax, ecx
            //   eb40                 | jmp                 0x42
            //   0fb701               | movzx               eax, word ptr [ecx]
            //   56                   | push                esi
            //   6685c0               | test                ax, ax

        $sequence_4 = { 8d45fc 50 51 51 51 ff7618 894dfc }
            // n = 7, score = 200
            //   8d45fc               | lea                 eax, [ebp - 4]
            //   50                   | push                eax
            //   51                   | push                ecx
            //   51                   | push                ecx
            //   51                   | push                ecx
            //   ff7618               | push                dword ptr [esi + 0x18]
            //   894dfc               | mov                 dword ptr [ebp - 4], ecx

        $sequence_5 = { 337024 337010 33701c d1c6 89701c 8b45fc }
            // n = 6, score = 200
            //   337024               | xor                 esi, dword ptr [eax + 0x24]
            //   337010               | xor                 esi, dword ptr [eax + 0x10]
            //   33701c               | xor                 esi, dword ptr [eax + 0x1c]
            //   d1c6                 | rol                 esi, 1
            //   89701c               | mov                 dword ptr [eax + 0x1c], esi
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]

        $sequence_6 = { 8bc1 c7410410000000 5d c20400 55 8bec 8b4508 }
            // n = 7, score = 200
            //   8bc1                 | mov                 eax, ecx
            //   c7410410000000       | mov                 dword ptr [ecx + 4], 0x10
            //   5d                   | pop                 ebp
            //   c20400               | ret                 4
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]

        $sequence_7 = { 33d2 c745fc03000000 8bc6 f775fc 8a041a 30040e 46 }
            // n = 7, score = 200
            //   33d2                 | xor                 edx, edx
            //   c745fc03000000       | mov                 dword ptr [ebp - 4], 3
            //   8bc6                 | mov                 eax, esi
            //   f775fc               | div                 dword ptr [ebp - 4]
            //   8a041a               | mov                 al, byte ptr [edx + ebx]
            //   30040e               | xor                 byte ptr [esi + ecx], al
            //   46                   | inc                 esi

        $sequence_8 = { 53 53 8d45e8 50 ff15???????? 85c0 742e }
            // n = 7, score = 200
            //   53                   | push                ebx
            //   53                   | push                ebx
            //   8d45e8               | lea                 eax, [ebp - 0x18]
            //   50                   | push                eax
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   742e                 | je                  0x30

        $sequence_9 = { e8???????? 84c0 0f8444010000 8d45d8 50 8d4dfc e8???????? }
            // n = 7, score = 200
            //   e8????????           |                     
            //   84c0                 | test                al, al
            //   0f8444010000         | je                  0x14a
            //   8d45d8               | lea                 eax, [ebp - 0x28]
            //   50                   | push                eax
            //   8d4dfc               | lea                 ecx, [ebp - 4]
            //   e8????????           |                     

    condition:
        7 of them and filesize < 1073152
}
[TLP:WHITE] win_azorult_w0   (20170930 | Match first two bytes, strings, and parts of routines present in Azorult)
rule win_azorult_w0 {
    meta:
        author = "Xylitol xylitol@temari.fr"
        date = "2017-09-30"
        description = "Match first two bytes, strings, and parts of routines present in Azorult"
        reference = "http://www.kernelmode.info/forum/viewtopic.php?f=16&t=4819"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult"
        malpedia_version = "20170930"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    // May only the challenge guide you
    strings:
        $string1 = "ST234LMUV56CklAopq78Brstuvwxyz01NOPQRmGHIJKWXYZabcdefgDEFhijn9+/" wide ascii // Azorult custom base64-like alphabet
        $string2 = "SYSInfo.txt"
        $string3 = "CookieList.txt"
        $string4 = "Passwords.txt"

        $constant1 = {85 C0 74 40 85 D2 74 31 53 56 57 89 C6 89 D7 8B 4F FC 57} // Azorult grabs .txt and .dat files from Desktop
        $constant2 = {68 ?? ?? ?? ?? FF 75 FC 68 ?? ?? ?? ?? 8D 45 F8 BA 03 00} // Portion of code from Azorult self-delete function
    condition:
      (all of ($string*) and ($constant1 or $constant2))
}
Download all Yara Rules