Editor’s note: The current article is authored by Mostafa ElSheimy, a malware reverse engineer and threat intelligence analyst. You can find Mohamed on X and LinkedIn.

In this malware analysis report, we conduct an in-depth examination of AZORult, a sophisticated credential and payment card information stealer.

Our walk-through covers the malware’s evolution, including its transition from Delphi to C++ and the introduction of .bit domain support. We will examine a sample of AZORult to uncover its behavior, evasion techniques, and operational tactics. This analysis aims to enhance understanding of AZORult’s functionality and inform effective countermeasures. 

Overview 

AZORult is a sophisticated credential and payment card information stealer that can also act as a downloader for various malware families. Notably, version 2 introduced support for .bit domains, enhancing its capabilities.

AZORult has been observed operating alongside Chthonic and has been deployed by Ramnit. Originally developed in Delphi, the malware was ported to C++ in 2019, which shows its evolution and increased complexity. 

Basic Analysis 

Let’s begin our analysis of a sample. Here’s its key details:

It’s important to note that the creation time has been edited by the author.

First we run the sample in the ANY.RUN sandbox to observe its behavior in a real-time and fully interactive virtual environment.

View the analysis session.

The sample initiates two critical processes: 

• Executes a PowerShell command 

• Drops a file belonging to the Azorult malware family 

The PowerShell command launches a script in a hidden window:

"powershell.exe" -windowstyle hidden "$Nummmeret=Get-Content 'C:\Users\admin\AppData\Local\Temp\forgrovelse\konstituerendes\Printermanualens.Ear';$Trojanerens=$Nummmeret.SubString(42833,3);.$Trojanerens($Nummmeret) " 

This command performs the following: 

• Reads the contents of a file located at C:\Users\admin\AppData\Local\Temp\forgrovelse\konstituerendes\Printermanualens.Ear and stores it in the variable $Nummmeret. 

• Extracts a substring from $Nummmeret, starting at index 42833 with a length of 3 characters, and stores this substring in the variable $Trojanerens. 

• Attempts to execute the content of $Trojanerens as a command or script, passing $Nummmeret as an argument to this command.

It also drops a file named Declinometer235.exe, the main AZORult payload.

The malware tries to contact thirteen IP addresses and one malicious domain.

An analysis of the sample using UnpacMe suggested that it was likely not packed.

 Let’s see the imports.

The malware queries, deletes, and modifies some registry keys, as well as uses an anti-debugging technique. 

The sample has a digital certificate. 

Advanced Analysis

Let’s now open the sample in IDA to take a closer look at its code.

We can see that it loads SHGetFolderPathW.

It gets TEMP path and sets an environment variable containing this path. 

It uses GetTickCount API to detect if their malware is being debugged.

Debugging often slows down the execution of a program. By checking the time taken between certain operations, the malware can detect anomalies.

If the time taken is unusually long, it might indicate the presence of a debugger.

The malware also creates, writes to, and reads a new file.

It returns the value of these functions to Buffer.

It queries the value under the key HKEY_CURRENT_USER\Control Panel\Desktop\ResourceLocale.

This code attempts to gain shutdown privileges by using SeShutdownPrivilege to either disrupt the system by forcing a shutdown or restart, or to ensure changes take effect after a restart. 

The function interacts with the clipboard, which could be used to steal or manipulate data. 

After looking at the strings section, we found the following: 

off_40940C contains these strings in .data section:

"GetDiskFreeSpaceExW" 

"MoveFileExW" 

"RegDeleteKeyExW" 

"OpenProcessToken" 

"LookupPrivilegeValueW" 

"AdjustTokenPrivileges" 

"GetUserDefaultUILanguage" 

"SHAutoComplete" 

"SHFOLDER" 

"SHGetFolderPathW"  

Let’s see the xrefs of off_40940C.

It uses LoadLibraryA and GetProcAddress to resolve these APIs.

The malware uses GetDiskFreeSpaceExW to check if there is enough disk space available before attempting to install or execute.

If the disk is nearly full, the malware might avoid installation to prevent detection or impact. 

LookupPrivilegeValueW/ AdjustTokenPrivileges 

Malware uses LookupPrivilegeValueW to get the LUID for a privilege like SE_DEBUG_NAME or SE_SYSTEM_ENVIRONMENT_NAME, which allow it to perform actions like debugging other processes or modifying system settings. 

It uses AdjustTokenPrivileges to: 

• Modify Privileges: By adjusting token privileges, malware can avoid detection by security software or make modifications to the system that are not typically allowed under normal user privileges. 
• Access Sensitive Operations: Malware might need elevated privileges to modify system settings, access protected files, or inject code into other processes. 

GetUserDefaultUILanguage 

This API provides the language used for the user interface of Windows. 

It is used to tailor the malware’s behavior or appearance based on the language of the system to avoid detection or appear more localized. 

Conclusion 

The AZORult malware represents a highly adaptable and sophisticated threat, evolving significantly since its initial development. As observed, AZORult employs various techniques to evade detection and maximize its impact, such as anti-debugging measures, use of environment variables, and privilege escalation. 

The malware’s ability to operate in hidden modes, drop additional malicious files, and interact with multiple IP addresses and domains underscores its potential for widespread damage.

The use of specific Windows API calls for tasks like checking disk space, adjusting token privileges, and manipulating system settings reflects a well-designed strategy to ensure persistence and effectiveness. The presence of digital certificates and obfuscation techniques further complicates detection and analysis.

About ANY.RUN  

ANY.RUN helps more than 400,000 cybersecurity professionals worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, YARA Search and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.  

With ANY.RUN you can: 

• Detect malware in seconds. 

• Interact with samples in real time. 

• Save time and money on sandbox setup and maintenance 

• Record and study all aspects of malware behavior. 

• Collaborate with your team 

• Scale as you need. 

Request free trial → 

IOCs

MD5 Hash

DNS requests 

IP connections

Registry keys

Mutexes 

MITRE ATT&CK TTPs