AZORult has been collecting banking details, crypto wallets, cookies, autofill data, desktop files and chat history since 2016. This note records how a January 2023 sample unpacks itself.
Delivery and persistence
The file arrives in a malicious archive from spam. Once launched it copies itself into the 32-bit system folder and creates a Windows service set to start automatically, which gives it persistence across reboots.
Unpacking in three layers
layer 1 VirtualAlloc -> VirtualProtect (RWX)
shift / XOR loop decrypts the next stage
JMP EAX lands in layer 2
layer 2 resolve APIs with GetProcAddress
XOR loop writes more code into newly allocated memory
layer 3 XOR decrypts the command-and-control URL
the host name is resolved with gethostbyname
The first loop uses shift and XOR instructions; the second is a plain XOR; the third decodes the C2 string. Stepping to each indirect jump is the reliable way to reach the next layer.
The batch file switch
Before it contacts the server, the sample writes and runs a small batch file. The result decides what happens next: if the batch executes, the original file is removed and the function ends; otherwise the program continues, decrypts the address and sends the data it has collected.
Network side
The C2 supplies extra DLLs. Those files are legitimate components of common applications, such as a SQLite library and browser modules, brought in so credentials can be read from their databases.
Notes
- Sample file type is a 32-bit executable built with an older Visual C++ toolchain.
- The service installation and the system-folder copy are good low-noise indicators.