AZORult is an information stealer malware that is targeted at stealing credentials and accounts. Updated multiple times over the years, AZORult continues to be an active concern for the users, stealing information such as banking passwords, credit card details, browser histories, and even cryptocurrency.

  • Type
  • Origin
  • First seen
    1 January, 2016
  • Last seen
    22 November, 2019
Global rank
Week rank
Month rank

What is AZORult malware?

AZORult is an information stealer malware that is targeted at stealing credentials and accounts. Updated multiple times over the years, AZORult continues to be an active concern for the users, stealing information such as banking passwords, credit card details, browser histories, and even cryptocurrency.

AZORult was discovered, analyzed and documented for the first time on July 26, 2016, by Proofpoint researchers. At the time, the virus was distributed together with another trojan called Chthonic. However, subsequent spam email campaigns started distributing AZORult as the main payload while Hermes and Aurora ransomwares were added as additional payloads. A new strain of the stealer Trojan was documented In July 2018. The analysis revealed that it brought several upgrades the functionality of both the stealer as well as to the loader of the virus, additionally, allowing to distribute AZORult with the RIG exploit kit. The latest recorded version of the malware is v3.3, this strain was first documented in October 2018. Most notably, this strain updated a way of encrypting the C&C domain string and improved crypto-stealing functionality.

General description of AZORult

A trojan type malware that originated in one of the ex-USSR countries, AZORult searches for useful information on the affected computer and sends it to the C2 server to potentially steal the victim’s bank account data. AZORult can steal cookies, browser autofill information, desktop files, chat history and more.

Interestingly, to get into a machine the virus in some cases requires secondary malware like HawkEye or Seamless. Notably, In campaigns with Hermes and Aurora, after every bit of useful data is obtained user files are encrypted and a ransom is requested to restore the lost data.

One of the interesting features of AZORult is that after execution the malware is removed from the system due to the lack of a persistence mechanism.

Malware analysis of AZORult

ANY.RUN displays the execution process of AZORult in an interactive virtual environment. As shown by the sandbox simulation, the virus launches the following process during its execution:

  • Firstly, a Microsoft Office file opened and WINWORD.EXE with enable macros is executed;
  • The malware runs EQNEDT32.EXE and downloads a malicious executable through the exploitation of the CVE-2017-11882 Microsoft Office Equation Editor vulnerability;
  • A 3.exe file is then launched which changes the autorun value in the registry. A malicious executable file then proceeds to make changes in the registry so that the system runs it at the system start;
  • A malicious executable file launches itself and then proceeds to steal the personal data and connect to the CnC server;
  • Then, a malicious executable file starts cmd.exe to delete itself after a 3-second timeout.

The execution process of AZORult can be viewed in more detail in the video provided by ANY.RUN

azorult execution process graph

Figure 1: Illustrates the life cycle of malware. Graph generated by ANY.RUN

How to avoid infection by AZORult?

AZORult is distributed mainly using spam email campaigns or via the RIG exploit kit. Notably, a major AZORult distribution campaign was observed on July 18, 2018, targeting North America.

Spam emails that were sent by the attackers carried largely employment-related subjects and included an infected and password protected resume file, that triggered the download of the virus.

AZORult execution process

Below is an illustration of the execution process created by the ANY.RUN interactive malware hunting service.

azorult execution process tree

Figure 2. AZORult execution process in ANY.RUN

text report of the azorult malware analysis

Figure 3: A text report generated by ANY.RUN

AZORult uses a clever technique to trick various antivirus engines. Particularly, version of the stealer Trojan distributed in July 2018 spam campaign was activated after unlocking a password protected document. Since the document that was attached to the email was protected by a password, antiviruses had not been able to scan it and determine whether it was malicious or not. For the virus to become active, the victim had to unlock and enable macros for the document. In this particular campaign, the malware was distributed with two payloads embedded in the main binary. Both payloads were dropped to the disk and executed with the first executable payload being the information gatherer – AZORult itself and then the secondary ransomware.

It should be noted, that in aforecited ANY.RUN simulation AZORult uses an exploit when a Microsoft Office file is opened, allowing to embed a number of malicious OLE objects into a document and executes arbitrary code on a machine and even download any file from a remote server and execute it.

How to share your Azorult malware analysis with others?

If you want to share your analysis with others you can create a text report and send it to anyone you want to, just click the "Text report" button. You can save it using your browser functionality either by clicking "Save page as..." or "Print..." buttons. Note that you can choose that information section in your report you want to print or save into a file using the "Print..." button by clicking on the little printer icon on the left side of the sections. On the illustration below the first section with a grey colored button won't be included in the report but a section with a black colored printer button will be.

text report for azorult Figure 4: Azorult text report


AZORult remains to be a highly dangerous trojan. The stealer Trojan has been upgraded throughout its lifespan and currently poses even more dangerous than during the first days of its lifespan. Particularly, most recent versions are distributed in bundles with ransomware and are able to steal cryptocurrency from the victims.

Its distribution in clever email campaigns makes becoming a victim of the stealer Trojan by accident relatively easy. Interactive sandbox analysis provided by services like ANY.RUN is a great way to learn more about the threat and greatly increase cybersecurity.


IP addresses


Adwind screenshot
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat and JSocket is a remote access trojan available as MaaS ( Malware-As-A-Service ). Adwind can collect user and system data, control the webcam of the infected machine, capture screenshots, install and run other malicious programs, log keystrokes, steal web browser passwords and more.
Read More
AgentTesla screenshot
agenttesla trojan rat stealer
Agent Tesla is a password stealer spyware that has been around since 2014. The malware can be used by attackers to spy on victims, allowing them to see everything that has been typed in supported programs and web-browsers.
Read More
Danabot screenshot
danabot trojan stealer
Danabot is a banking trojan that was spotted in the wild in 2018. Danabot differs from competing Trojans thanks to its robust delivery system and modular design. Since its first appearance, Danabot has obtained high popularity among cybercriminals and became an active threat in multiple regions of the world.
Read More
Dridex screenshot
dridex trojan banker
Dridex is one of the most technologically advanced banking trojans currently active. The primary target of this malware is stealing banking credentials from its victims. Dridex has been around since 2014 and has benefited from very consistent updates that helped the malware evolve and become more and more capable.
Read More
Emotet screenshot
emotet trojan loader banker
Emotet is an extremely sophisticated and destructive banking Trojan used to download and install other malware. First recorded in 2014, Emotet has gained advanced capabilities over the course of its lifetime. Today Emotet is targeting governments, corporations, small businesses and individuals, focusing on Europe, America, and Canada.
Read More
FlawedAmmyy screenshot
flawedammyy trojan rat
FlawedAmmyy is a Remote Access Trojan – a malware that is utilized by attackers to take full control over the target machine. It is based on the source code of a completely legitimate program Ammyy Admin. Despite this RAT being recorded as a new malware in 2018, some researchers suggest that it has been in use since 2016.
Read More