S0344 - Azorult

Name: S0344 - Azorult
Creator: Maltiverse
Published: 2023-03-27

Azorult is a commercial Trojan that is used to steal information from compromised hosts. Azorult has been observed in the wild as early as 2016.In July 2018, Azorult was seen used in a spearphishing campaign against targets in North America. Azorult has been seen used for cryptocurrency theft.

Author: agomez
Created: 2023-03-27 16:03:56
Last updated: 2026-02-07 18:40:04
Downloads: 418244
IPv4 indicators: 15
Hostname indicators: 46
URL indicators: 15
Sample indicators: 146

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

ccilfov.ro Hostname

modified 2026-10-18 04:39:02
Ransomware Locky distribution site (Ransomware Tracker) · Ransomware (Ransomware Tracker) · Malicious domain (SANS Internet Storm Center) · Covid19 scam (Cyber Threat Coalition) · Malicious url (Cyber Threat Coalition)

allenservice.ga Hostname

modified 2026-10-18 04:36:23
Malware Download (Abuse.ch) · AZORult (Cybercrime-tracker.net) · Generic.Malware (Hybrid-Analysis) · Covid19 scam (Cyber Threat Coalition) · Malicious url (Cyber Threat Coalition)

www.ausvanlines.com.au Hostname

modified 2026-10-18 04:35:38
Azorult (ThreatFox Abuse.ch) · Cobalt Strike (ThreatFox Abuse.ch) · Malicious URL (Hybrid-Analysis)

http://allenservice.ga/~zadmin/azrt/aps/panel/admin.php URL

modified 2026-10-18 02:37:12
AZORult (Cybercrime-tracker.net)

https://diaymako.com/index.php URL

modified 2026-10-18 02:30:22
Azorult (ThreatFox Abuse.ch)

legalson.com Hostname

modified 2026-10-18 00:40:38
Azorult (ThreatFox Abuse.ch) · AZORult (Cybercrime-tracker.net)

x7x.xyz Hostname

modified 2026-10-18 00:39:48
AZORult (Cybercrime-tracker.net)

automatia.in Hostname

modified 2026-10-18 00:37:21
Azorult (ThreatFox Abuse.ch) · Trojan.Generic (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis) · Loki Password Stealer (PWS) (ThreatFox Abuse.ch)

http://cpinfo.sustainable-development-partners.com/index.php URL

modified 2026-10-17 22:33:00
Azorult (ThreatFox Abuse.ch)

cpinfo.sustainable-development-partners.com Hostname

modified 2026-10-17 20:38:50
Azorult (ThreatFox Abuse.ch)

diaymako.com Hostname

modified 2026-10-17 20:36:34
Azorult (ThreatFox Abuse.ch)

62.171.146.116 IPv4

modified 2026-10-17 20:00:31
PredatorTheThief (Cybercrime-tracker.net) · AZORult (Cybercrime-tracker.net) · Malicious Host (HoneyDB) · Port Scanner (AbuseIPDB) · HTTP Scrapper (AbuseIPDB)

5.9.253.157 IPv4

modified 2026-10-17 18:02:56
Anonymizer (FireHol) · Anonymizer (Maltiverse) · azorult (Maltiverse Research Team) · Anonymizer (Maltiverse Research Team) · Proxy (IPWhois.io)

5.9.155.75 IPv4

modified 2026-10-17 18:02:49
Anonymizer (FireHol) · Generic.Malware (Hybrid-Analysis) · Emotet (Telefonica CO SOC) · AZORult (Cybercrime-tracker.net) · CoinMiner (Cybercrime-tracker.net)

3.15.140.156 IPv4

modified 2026-10-17 17:09:21
AZORult (Cybercrime-tracker.net) · Proxy (IPWhois.io) · Mail Spammer (Barracuda) · Anonymizer (FireHOL) · Proxy (FireHOL)

http://x7x.xyz/ URL

modified 2026-10-17 16:42:20
AZORult (Cybercrime-tracker.net)

devilhimself.bounceme.net Hostname

modified 2026-10-17 16:41:58
Azorult (ThreatFox Abuse.ch) · Malicious site (Hybrid-Analysis) · Top Popularity Site (Cisco Umbrella)

clamprite.ga Hostname

modified 2026-10-17 16:41:36
Agent Tesla (ThreatFox Abuse.ch) · Azorult (ThreatFox Abuse.ch)

iscm.edu.ar Hostname

modified 2026-10-17 16:38:15
Azorult (ThreatFox Abuse.ch) · Malware site (Hybrid-Analysis) · Malicious site (Hybrid-Analysis) · Kryptik.WBC (Hybrid-Analysis) · Trojan.Inject (Hybrid-Analysis)

neevavantgarde.com Hostname

modified 2026-10-17 16:37:33
Azorult (ThreatFox Abuse.ch) · Malicious domain (SANS Internet Storm Center) · Citadel (Cybercrime-tracker.net)

zi-chem.co Hostname

modified 2026-10-17 16:35:21
Azorult (ThreatFox Abuse.ch) · AZORult (Cybercrime-tracker.net) · Lokibot (Cybercrime-tracker.net)

efore.info Hostname

modified 2026-10-17 16:35:11
AZORult (Cybercrime-tracker.net) · Malware Download (Abuse.ch) · Lokibot (Cybercrime-tracker.net)

objects.githubusercontent.com Hostname

modified 2026-10-17 16:34:48
Safe Site (Cisco Umbrella) · Trojan.Packed.oa (Hybrid-Analysis) · Trojan.Siggen16 (Hybrid-Analysis) · malicious.238d08 (Hybrid-Analysis) · Trojan.Siggen15 (Hybrid-Analysis)

abscete.info Hostname

modified 2026-10-17 16:34:48
Azorult (ThreatFox Abuse.ch) · Lokibot (Cybercrime-tracker.net) · Backdoor.Androm (Hybrid-Analysis) · Loki Password Stealer (PWS) (ThreatFox Abuse.ch)

hojokk.com Hostname

modified 2026-10-17 16:34:48
Lokibot (Cybercrime-tracker.net) · Gomorrah (Cybercrime-tracker.net) · AZORult (Cybercrime-tracker.net) · Malicious site (Hybrid-Analysis) · Covid19 scam (CCN-CERT)

https://github.com/Da2dalus/The-MALWARE-Repo URL

modified 2026-10-17 16:00:28
Revengerat (Triage) · Modiloader (Triage) · Danabot (Triage) · Mydoom (Triage) · Killmbr (Triage)

softopia.space Hostname

modified 2026-10-17 12:53:36
Azorult (ThreatFox Abuse.ch) · Generic.Malware (Hybrid-Analysis) · Malicious domain (SANS Internet Storm Center)

guifenergy.co.ke Hostname

modified 2026-10-17 12:38:57
Azorult (ThreatFox Abuse.ch) · Top Popularity Site (Cisco Umbrella)

http://allenservice.ga/~zadmin/azrt/j2/panel/admin.php URL

modified 2026-10-17 10:41:29
AZORult (Cybercrime-tracker.net)

skyroot.ru Hostname

modified 2026-10-17 08:39:24
Gorynych (Cybercrime-tracker.net) · Trojan.Generic (Hybrid-Analysis) · AZORult (Cybercrime-tracker.net)

mosoli.com Hostname

modified 2026-10-17 08:38:42
Azorult (ThreatFox Abuse.ch) · AZORult (Cybercrime-tracker.net) · Malware distribution site (VxVault) · Malicious domain (SANS Internet Storm Center) · Sateto (Cybercrime-tracker.net)

www.11n.us Hostname

modified 2026-10-17 08:37:55
AZORult (Cybercrime-tracker.net)

https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Stealer URL

modified 2026-10-17 06:39:49
Azorult (Triage)

http://efore.info/blessed/panel/admin.php URL

modified 2026-10-17 03:10:50
AZORult (Cybercrime-tracker.net)

erxst.info Hostname

modified 2026-10-17 00:40:28
Azorult (ThreatFox Abuse.ch) · Malware Download (Abuse.ch) · Malware (Hybrid-Analysis) · Trojan.Generic (Hybrid-Analysis) · Loki Password Stealer (PWS) (ThreatFox Abuse.ch)

ciuj.ir Hostname

modified 2026-10-17 00:40:05
AZORult (Cybercrime-tracker.net) · DangerousObject.Multi (Hybrid-Analysis) · Gen:Variant.Ursu (Hybrid-Analysis) · Covid19 scam (Cyber Threat Coalition) · Malicious url (Cyber Threat Coalition)

livdecor.pt Hostname

modified 2026-10-17 00:38:15
Azorult (ThreatFox Abuse.ch) · AZORult (Cybercrime-tracker.net) · Covid19 scam (Cyber Threat Coalition) · Malicious url (Cyber Threat Coalition) · Malicious site (Hybrid-Analysis)

zevs.xyz Hostname

modified 2026-10-16 20:38:17
AZORult (Cybercrime-tracker.net)

jusqit.com Hostname

modified 2026-10-16 20:36:35
Azorult (ThreatFox Abuse.ch) · Malicious site (Hybrid-Analysis) · Dldr.Agent (Hybrid-Analysis) · AZORult (Cybercrime-tracker.net) · HEUR:Trojan.MSOffice.SAgent (Hybrid-Analysis)

jaffacakes118_Trojan-PSW.Win32.Coins.lge.8952e8d67f3637845e670a9f98880699 Sample

modified 2026-10-16 07:16:49
Azorult (Triage)

jaffacakes118_Trojan-PSW.Win32.Coins.bwt.e2122e83b3d246b08640524f47410aa4 Sample

modified 2026-10-16 07:16:43
Azorult (Triage)

jaffacakes118_Trojan-PSW.Win32.Azorult.smx.eeae39831b4ecd52eb5b8118da2a8af5 Sample

modified 2026-10-16 07:16:30
Azorult (Triage)

jaffacakes118_Trojan-PSW.Win32.Azorult.kcv.94878b8582818a840594711f39671911 Sample

modified 2026-10-16 07:16:24
Azorult (Triage)

jaffacakes118_Trojan-PSW.Win32.Azorult.gqa.27a7c663d729b7ba1b23729a83465413 Sample

modified 2026-10-16 07:16:16
Azorult (Triage)

jaffacakes118_Trojan-PSW.Win32.Azorult.afck.8a6103160b6906b57c4a2c1b49e56be5 Sample

modified 2026-10-16 07:16:05
Azorult (Triage)

jaffacakes118_Trojan-Ransom.Win32.Blocker.lcqq.0303219f22e46e719e1fe3b5471d3d91 Sample

modified 2026-10-16 05:22:37
Azorult (Triage)

jaffacakes118_Trojan-Ransom.Win32.Blocker.lcqk.b5f62ac5dd2474908e9465160cf61eda Sample

modified 2026-10-16 05:22:31
Azorult (Triage)

jaffacakes118_Trojan-Ransom.Win32.Blocker.lcmq.31e05556959b1c1d4cae50dee2cee8a3 Sample

modified 2026-10-16 05:22:26
Azorult (Triage)

jaffacakes118_Trojan-Spy.Win32.SpyEyes.befp.aaa61e69a246e57abb948f686154e03a Sample

modified 2026-10-16 04:36:15
Azorult (Triage)

jaffacakes118_Trojan.MSIL.Crypt.gmus.866fdd2f90986484ca3e8a97246e0224 Sample

modified 2026-10-16 03:29:00
Azorult (Triage)

jaffacakes118_Trojan.MSIL.Crypt.gmra.1718b2c9b3218aebc4c1472fa6270467 Sample

modified 2026-10-16 03:28:47
Azorult (Triage)

jaffacakes118_Trojan.Win32.Agentb.jjtu.095f9d0f0812883c14c720a359fba7c2 Sample

modified 2026-10-15 21:27:52
Azorult (Triage)

cbmagency.com Hostname

modified 2026-10-15 16:39:28
Emotet (Telefonica CO SOC) · Emotet (Abuse.ch) · Malware Download (Abuse.ch) · Malware (Mr.Looquer) · AZORult (Mr.Looquer)

185.140.53.5 IPv4

modified 2026-10-15 10:08:59
Nanocore RAT (ThreatFox Abuse.ch) · IOC_19052020 (CronUp Threat Intel) · SSH Attacker (Blocklist.net.ua) · Malicious Host (HoneyDB) · HTTP Spammer (Sblam)

jaffacakes118_Trojan-PSW.Win32.Azorult.sna.0ea8a35d4cf5e72615138f2449670924 Sample

modified 2026-10-15 08:38:34
Azorult (Triage)

3376d018a1f90739d3da7ce522215999f388248193f4328a5eb362f0d9a22c6b Sample

modified 2026-10-15 05:06:18
Azorult (Cyber Threat Alliance) · Barys (Cyber Threat Alliance)

jaffacakes118_Backdoor.Win32.AutoIt.ed.020bcbe3bcb1e3ce5a336 Sample

modified 2026-10-15 04:08:45
Azorult (Triage)

e8ad3327cd05d4d3179d8b7dccc82d7db170dc0b4d3a46ea711bad5e93198cba Sample

modified 2026-10-14 16:17:19
Azorult (Cyber Threat Alliance)

jaffacakes118_UDS.DangerousObject.Multi.Generic.3a783d6a0e3505903843983e413a529e Sample

modified 2026-10-14 11:23:21
Azorult (Triage)

jaffacakes118_Trojan-Ransom.Win32.Blocker.ldpe.0923de94897e0707a089e3c3bc315636 Sample

modified 2026-10-14 09:55:06
Azorult (Triage)

jaffacakes118_Trojan-PSW.Win32.Azorult.dge.71f25b369f50555c7b41939964dfde7c Sample

modified 2026-10-14 09:37:02
Azorult (Triage)

cee77140e5a89c46386e1584146c7677539ce7cb556fb7b22717bccc0c65c8e9 Sample

modified 2026-10-14 00:21:35
Azorult (Cyber Threat Alliance)

jaffacakes118_Trojan-Spy.Win32.SpyEyes.bdzt.22f54ca42ba147c966e901a13d55c2fc Sample

modified 2026-10-13 20:00:52
banker,zbot,zeus (Maltiverse) · Azorult (Triage)

jaffacakes118_HEUR.Backdoor.MSIL.Remcos.gen.d2459608c3d870b8bcbde673c41e084a Sample

modified 2026-10-13 19:38:18
Azorult (Triage)

keygenninja.com Hostname

modified 2026-10-13 08:31:39
Scam (Maltiverse) · Generic Malware (Maltiverse Threat Observatory) · Malicious behavior (Maltiverse Threat Observatory) · Azorult (Triage) · Azorult (Maltiverse Threat Observatory)

http://keygenninja.com URL

modified 2026-10-13 08:31:39
Azorult (Triage) · Azorult (Maltiverse Threat Observatory)

jaffacakes118_sample.bin Sample

modified 2026-10-12 06:01:48
Trojan.Generic (Hybrid-Analysis) · Azorult (Triage)