{"id":8690,"date":"2024-09-04T05:49:49","date_gmt":"2024-09-04T05:49:49","guid":{"rendered":"\/cybersecurity-blog\/?p=8690"},"modified":"2024-09-04T06:31:06","modified_gmt":"2024-09-04T06:31:06","slug":"azorult-malware-analysis","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/azorult-malware-analysis\/","title":{"rendered":"AZORult Malware: Technical Analysis"},"content":{"rendered":"\n

Editor\u2019s note: The current article is authored by Mostafa ElSheimy, a malware reverse engineer and threat intelligence analyst. You can find Mostafa on\u00a0X<\/a>\u00a0and\u00a0LinkedIn<\/a>.<\/em><\/p>\n\n\n\n

In this malware analysis report, we conduct an in-depth examination of AZORult, a sophisticated credential and payment card information stealer.<\/p>\n\n\n\n

Our walk-through covers the malware’s evolution, including its transition from Delphi to C++ and the introduction of .bit domain support. We will examine a sample of AZORult to uncover its behavior, evasion techniques, and operational tactics. This analysis aims to enhance understanding of AZORult\u2019s functionality and inform effective countermeasures. <\/p>\n\n\n\n

Overview <\/h2>\n\n\n\n

AZORult is a sophisticated credential and payment card information stealer<\/a> that can also act as a downloader<\/a> for various malware families. Notably, version 2 introduced support for .bit domains, enhancing its capabilities. <\/p>\n\n\n\n

AZORult has been observed operating alongside Chthonic and has been deployed by Ramnit. Originally developed in Delphi, the malware was ported to C++ in 2019, which shows its evolution and increased complexity. <\/p>\n\n\n\n

Basic Analysis <\/h2>\n\n\n\n

Let’s begin our analysis of a sample. Here’s its key details:<\/p>\n\n\n\n

\n \n\n \n \n
\n Sample Hash <\/td>\n \n 90a82defe606e51d2826265a43737130682b738241700782d7e41188475b7fb7 <\/td>\n <\/tr>\n
\n Creation Time <\/td>\n \n 2013-12-25 05:01:38 UTC <\/td>\n <\/tr>\n <\/table>\n<\/div>