Some cyber criminals have created a web page impersonating the official website of a tool called BleachBit. The cyber criminals spread the AZORult information stealer in the name of this tool. BleachBit is a tool that helps Windows, Linux, and macOS users reclaim disk space by deleting disposable data and has more than one million downloads on Sourceforge.
AZORult is a stealer built to collect various types of sensitive data from an infected computer such as browser history, saved logins, stored credentials in FTP clients, desktop and text files, and more. When designing the malicious site, the domain bleachbitcleaner[.]com was used to appear legitimate. The webpage has only one link available which leads to AZORult, along with the embedded video tutorial for a beta version of the program released in 2009. Data is taken from infected computers to twooo[.]cn.
Once installed, AZORult contacts its command and control (C2) server for instructions. It can collect browser history, login credentials, cookies, and files in specific locations. Fooled users download a ZIP archive from Dropbox which steals a victim’s data on execution and uploads it to the attacker’s command and control servers.
Attack vector for this attack is still unclear. Threat actors may get victims to visit the fake webpage via search engines or manually push the fake website on support forums. They may also target users looking to securely erase sensitive data. They could also use phishing emails and push the link through email attachments.
Malware Hash (MD5/SHA1/SH256)