AZORult++

To do so, AZORult++ creates a user account using the NetUserAdd() function... before adding this account to the Administrators group

The malware creates a new, hidden administrator account on the machine, and sets a registry key to establish a Remote Desktop Protocol (RDP) connection.

The malware creates a new, hidden administrator account on the machine, and sets a registry key to establish a Remote Desktop Protocol (RDP) connection.

To do so, AZORult++ creates a user account using the NetUserAdd() function... before adding this account to the Administrators group

Like AZORult 3.3, AZORult++ uses an XOR operation with a 3-byte key to encrypt data sent to the C&C server.

The malicious cherry on the cake is a call to ShellExecuteW() to open a port to establish a remote connection to the desktop

like many other threats it first checks the language ID of the target machine and stops its execution if it identifies Russian, Armenian, Azerbaijani, Belarusian, Georgian, Kazakh, Tajik, Turkmen, or Uzbek.

Next, AZORult++ hides the newly created account by setting the value of the Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist registry key to 0.

The malware creates a new, hidden administrator account on the machine, and sets a registry key to establish a Remote Desktop Protocol (RDP) connection.

In a nutshell AZORult is a Trojan stealer that collects various data on infected computers and sends it to the C&C server, including browser history, login credentials, cookies...

AZORult is able to collect targets browser history, login credentials, crypto-wallet files cookies, files from the infected systems, and more.

like many other threats it first checks the language ID of the target machine and stops its execution if it identifies Russian, Armenian, Azerbaijani, Belarusian, Georgian, Kazakh, Tajik, Turkmen, or Uzbek.

AZORult++ starts out by checking the language ID through a call to the GetUserDefaultLangID() function. If AZORult++ is running on a system where the language is identified as Russian, Armenian, Azerbaijani, Belarusian, Georgian, Kazakh, Tajik, Turkmen, or Uzbek, the malware stops executing.

The most concerning improvement for the C++ version is the ability to establish a remote connection to the compromised machines via RDP. The malware creates a new, hidden administrator account on the machine, and sets a registry key to establish a Remote Desktop Protocol (RDP) connection.

AZORult is able to collect targets browser history, login credentials, crypto-wallet files cookies, files from the infected systems, and more.

Original AZORult 3.3 and AZORult++ uses the same algorithm for communication with the C&C server, they use the command format, the structure and method of storing harvested data, and encryption keys.