Azorult

MITRE ATT&CK: S0344 View on attack.mitre.org

Aliases: PuffStealer, Rultazo, Azorult

First seen
2016-01-01 00:00:00
Malware type
trojan, credential-stealer
Family
Malware family
Operating systems
windows
Related IoCs
6706 (4193 malicious)
Last IoC activity
2026-10-18 04:11:15
Profile updated
2026-07-07 12:54:44

Targeted industries: financial-services retail-and-hospitality

Targeted regions: country_code:us

Context

Azorult is a commercial Trojan that is used to steal information from compromised hosts. Azorult has been observed in the wild as early as 2016. In July 2018, Azorult was seen used in a spearphishing campaign against targets in North America. Azorult has been seen used for cryptocurrency theft.

Recent IoC activity

4,193 malicious indicators in Maltiverse are attributed to Azorult (S0344). The 20 most recently updated:

TypeIndicatorUpdatedSources
hostname ccilfov.ro 2026-10-18 4
hostname allenservice.ga 2026-10-18 4
hostname www.ausvanlines.com.au 2026-10-18 2
URL http://allenservice.ga/~zadmin/azrt/aps/panel/admin.php 2026-10-18 1
URL https://diaymako.com/index.php 2026-10-18 1
hostname legalson.com 2026-10-18 2
hostname x7x.xyz 2026-10-18 1
hostname automatia.in 2026-10-18 2
URL http://cpinfo.sustainable-development-partners.com/index.php 2026-10-17 1
hostname cpinfo.sustainable-development-partners.com 2026-10-17 1
hostname diaymako.com 2026-10-17 1
IP address 62.171.146.116 2026-10-17 5
IP address 5.9.253.157 2026-10-17 6
IP address 5.9.155.75 2026-10-17 7
IP address 3.15.140.156 2026-10-17 4
URL http://x7x.xyz/ 2026-10-17 1
hostname devilhimself.bounceme.net 2026-10-17 3
hostname clamprite.ga 2026-10-17 1
hostname iscm.edu.ar 2026-10-17 3
hostname neevavantgarde.com 2026-10-17 3

Detection coverage

  • 2 YARA rules
  • 252 Sigma rules

Malware & tools used

  • File Deletion (attack-pattern)
  • Symmetric Cryptography (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Process Hollowing (attack-pattern)
  • Query Registry (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Credentials In Files (attack-pattern)
  • Credentials from Web Browsers (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • System Time Discovery (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Screen Capture (attack-pattern)
  • Process Discovery (attack-pattern)
  • Create Process with Token (attack-pattern)

Used by threat actors

Detection rules

  • MALPEDIA_Win_Azorult_Auto (yara-rule)
  • CAPE_Azorult (yara-rule)

Reports & references

  • go.recordedfuture.com — Cta 2022 0802 (report)
  • spamhaus.org — 2020 Q2 Spamhaus Botnet Threat Report (report)
  • marcoramilli.com — C2 Traffic Patterns Personal Notes (report)
  • proofpoint.com — New Whiteshadow Downloader Uses Microsoft Sql Retrieve Malware (report)
  • ciphertechsolutions.com — Roboski Global Recovery Automation (report)
  • securityintelligence.com — Roboski Global Recovery Automation (report)
  • telekom.com — Cybersecurity Ta505 S Box Of Chocolate 597672 (report)
  • medium.com — Inside View Of Brazzzersff Infrastructure 89B9188Fd145 (report)
  • medium.com — Operation Synctrek E5013Df8D167 (report)
  • yoroi.company — Aggah How To Run A Botnet Without Renting A Server For More Than A Year (report)
  • cocomelonc.github.io — Simple Malware Av Evasion (report)
  • ke-la.com — Information Stealers A New Landscape (report)
  • blueliv.com — Using Qiling Framework To Unpack Ta505 Packed Samples (report)
  • outpost24.com — Using Qiling Framework To Unpack Ta505 Packed Samples (report)
  • cybereason.com — The Hole In The Bucket Attackers Abuse Bitbucket To Deliver An Arsenal Of Malware (report)
  • community.riskiq.com — 56E28880 (report)
  • MITRE ATT&CK — S0344 (report)
  • researchcenter.paloaltonetworks.com — Unit42 New Wine Old Bottle New Azorult Variant Found Findmyname Campaign Using Fallout Exploit Kit (report)
  • blog.minerva-labs.com — Analyzing An Azorult Attack Evasion In A Cloak Of Multiple Layers (report)
  • malware.lu — Azorult Stealer (report)
  • bleepingcomputer.com — Azorult Trojan Serving Aurora Ransomware By Malactor Oktropys (report)
  • resources.malwarebytes.com — Ctnt Q1 2020 Covid Report Final (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Azorult (report)
  • proofpoint.com — Threat Actors Using Legitimate Paypal Accounts To Distribute Chthonic Banking Trojan (report)
  • Cisco Talos — Tor2Mine Is Up To Their Old Tricks And 11 (report)

External references