Rewterz Threat Alert – AZORult Malware – Active IOCs

Severity

High

Analysis Summary

AZORult is a payment card and credential information stealer. It was sold on Russian underground forums as a means to collect sensitive information from infected systems. The malware is also able to steal cookies, browsing history, cryptocurrency, and ID/passwords. Exploits such as phishing emails and Fallout Exploit Kit (EK) paired with social engineering techniques are major infection vectors of the AZORult malware. The malware can also be used as a loader to download other malware.

Impact

• Information Theft
• Credential Theft
• Exposure of Sensitive Data

Indicators of Compromise

MD5

• 5c1517e5b5419f5d30fe9b6ad4581c9b

SHA-256

• 31d0bc059f661f56de4c0af4ef3bf64806893bb6e8742ba6a43b6594dde7e681

SHA-1

• 2cdc04fe1aabb22f57093fbfd1cd2ea852c42760

URL

• http[:]//auxinity[.]000webhostapp[.]com/index[.]php
• http[:]//ailsom[.]ac[.]ug/pm[.]exe
• http[:]//ailsom[.]ac[.]ug/cc[.]exe
• http[:]//matisaas[.]ac[.]ug/asdfg[.]exe
• http[:]//colonna[.]ac[.]ug/
• http[:]//colonna[.]ac[.]ug/main[.]php
• http[:]//colonna[.]ac[.]ug/vcruntime140[.]dll
• http[:]//colonna[.]ac[.]ug/sqlite3[.]dll
• http[:]//colonna[.]ug/index[.]php
• http[:]//colonna[.]ac[.]ug/mozglue[.]dll

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.
• Always be suspicious about emails sent by unknown senders.
• Never click on links sent by unknown senders.