Azorult

Azorult is a type of malware, or malicious software, that infiltrates systems to exploit and damage them, often without the user's knowledge. It has historically been one of the favored infostealers sold on the marketplace 2easy, alongside RedLine, Raccoon, Vidar, and Taurus. However, as of late February 2023, it stopped carrying Taurus and Azorult logs. The malware can be downloaded and executed through various means, including suspicious downloads, emails, websites, and even bogus Google Sites pages, as observed in a new campaign discovered by cybersecurity researchers on March 18, 2024. This sophisticated malware goes beyond simple data theft; it captures screenshots of the system, creating a comprehensive profile of the compromised system. The ultimate payload, a 32-bit Azorult .Net executable, exhibits a range of malicious activities. Subsequent stages include downloading an additional loader from a remote server, injecting shellcode into memory, and ultimately executing the Azorult malware. This meticulous multistage infection chain is carefully orchestrated to avoid detection, making Azorult a formidable adversary in the realm of cybersecurity. Despite its cessation on the 2easy marketplace, Azorult continues to pose a significant threat to cybersecurity due to its ability to adapt, employ obfuscation techniques, and execute entirely within the system’s memory. Victims whose credentials have been compromised by infostealers like Azorult have been notified by Resecurity. The resurgence of the Azorult malware highlights the ongoing risk it presents, with its complex campaign underscoring the continuous evolution and adaptation of cyber threats.