New Variant of AZORult Trojan Written in C++

guest · Mar 22, 2019

New Variant of AZORult Trojan Written in C++
March 22, 2019
https://www.infosecurity-magazine.com/news/new-variant-of-azorult-trojan-1/

After analyzing several previously unknown malicious files that were detected earlier this month, Kaspersky Lab determined the files were a new version of a data stealer known as the AZORult Trojan. Because the files are written in C++, and not Delphi, researchers have dubbed the variant AZORult++.

According to researchers, this latest version is potentially more dangerous than earlier variants. In addition to amassing data – including credentials, browser history and cookies – and distributing it to command-and-control (C&C) servers, AZORult++ can also establish a remote desktop connection by creating a new user account and discreetly adding it to the administrators’ group.

“Despite its many flaws, the C++ version is already more threatening than its predecessor due to the ability to establish a remote connection to the desktop,” Eremin said.
Click to expand...

Kaspersky: AZORult++: Rewriting history

itman · Mar 22, 2019

Nasty stuff. Per the Kaspersky write-up:

For all its flaws, AZORult++ could actually be more dangerous than its predecessor due to its ability to establish a remote connection to the desktop. To do so, AZORult++ creates a user account using the NetUserAdd() function (username and password are specified in the AZORult++ code), before adding this account to the Administrators group:

Next, AZORult++ hides the newly created account by setting the value of the Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist registry key to 0. Likewise, through setting registry key values, a Remote Desktop Protocol (RDP) connection is allowed:

The malicious cherry on the cake is a call to ShellExecuteW() to open a port to establish a remote connection to the desktop:
Click to expand...

Log in or Sign up

New Variant of AZORult Trojan Written in C++

guest Guest

itman Registered Member

Log in or Sign up

New Variant of AZORult Trojan Written in C++

guest Guest

itman Registered Member

Useful Searches