Azorult

Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.

This malware is most commonly found after Spear-Phishing or a Web site that has been compromised.

This malware usually starts from an initial point as documents via Spear-Phishing or compromised web pages

Create tasks to create persistence: schtasks /create /tn /tr "<FilePath>" /sc minute /mo 1 /F

using sleeps through PS to avoid the sandbox analysis timeout or delay the execution

the most common is to see executions of this one doing the first phase launching several cmd.exe to support itself in the execution while dropping other files

office docs with malicious macros that in turn download the Trojan

By relying on basic social engineering – an attack technique that takes advantage of human traits such as curiosity, trust and greed in order to obtain confidential information or to have the victim perform a certain action – it is suffice to say that certain threat actors (both criminal and nation state) are exploiting these unprecedented times for various nefarious means.

Most often, this is done by sending emails with malicious attachments (for example, office docs with malicious macros that in turn download the Trojan).

Create tasks to create persistence: schtasks /create /tn /tr "<FilePath>" /sc minute /mo 1 /F

Modify Office settings, where we can see how the Resilience or the MRU that would make changes

Create tasks to create persistence: schtasks /create /tn /tr "<FilePath>" /sc minute /mo 1 /F

be able to execute elements in a different thread with the context from which it has obtained all the information related to the credentials of the main process

look for permissions that it has in execution via Token to then be able to execute elements in a different thread

AZORult seen, mostly were either .NET obfuscated with SmartAssembly or AutoIT

be able to execute elements in a different thread with the context from which it has obtained all the information related to the credentials of the main process

cmd.exe /c C:\Windows\system32\timeout.exe 3 & del "<FilePath>"

look for permissions that it has in execution via Token to then be able to execute elements in a different thread

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

Subsequently, we can see how he tries to avoid reinfection with Mutex, but not all samples used the mutex.

using sleeps through PS to avoid the sandbox analysis timeout or delay the execution

We can see from anti-dbg where it is observed if there is any thread with the DBG, or locating the HEAP flags

Modify Office settings, where we can see how the Resilience or the MRU that would make changes

Collect data from browsers: Passwords Autofill data Payment cards Cookies

it obtains information from elements such as: Mail informaton Wallets FTP Browsers information (Cookies, History…) SSH (Putty|WinSCP)

Collect data from browsers: Passwords Autofill data Payment cards Cookies

The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

it actually tries to control at several points which processes are running on the system, usually linked to anti-analysis

The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.

The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").

using sleeps through PS to avoid the sandbox analysis timeout or delay the execution

Examples include "Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found," "DropBook has checked for the presence of Arabic language," and "Maze has checked the language of the infected system using the GetUSerDefaultUILanguage function."

We can see from anti-dbg where it is observed if there is any thread with the DBG, or locating the HEAP flags

Copy files: All files from a specific directory (such as Desktop) Files with a specific extension (TXT, DOCX) Files for specific apps (cryptocurrency wallets, messenger session files)

Take screenshots

the mask %USERPROFILE%\Desktop\ *.txt,*.jpg,*.png,*.zip,*.rar,*.doc means that all files with the specified extensions from the victim’s desktop are to be sent to the malware operator

before running most of its functions had a check where checks if it reached the C2, if this did not happen, automatically stopped the execution

In the log we can see that: A client 96.57.xx.xxx Sent a web request “GET tuneappservice.org/l3k42hj56h634gkj2lk14356jk4gh23k5jl6h4/gate.php?ped=RTY3M0E4NjhDQ0I5JE1DLTEwNw” We can see here what looks like a malware callback, it’s in fact Riltok.

The service is described as a Fast flux but in reality it’s more a simple proxy system. BraZZZers rents a pool of VPSs all around the internet and uses them as proxy IPs in order to hide the real IP of a server.

Если пользователь устанавливает такое «обновление», на устройство жертвы загружается малварь

The domains involved are resolving to a list of IPs, (we observed from 1 up to more than 20 IPs per domain) that are just redirecting the traffic to the real server.

The story we are writing here will try to explain how, from a simple mistake made by an operator, we managed to collect and exploit a lot of precious information from a “Fast Flux” network called BraZZZerS Fast Flux between end of 2018 and 2022.

Once you have obtained everything you wanted you make requests to the C&C with all the data you have obtained.

I also find the ability to control the device by remotely shutting it down or suspending it using the Suspend + Force flag