MALWARE FAMILY

Azorult

Internal ID: win.azorult

aliases

Last seen:Mar 17, 2026

Intelligence Profile

AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.

Threat Analysis

Azorult is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://www.vkremez.com/2017/07/lets-learn-reversing-credential-and.html

→https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/

→https://any.run/cybersecurity-blog/azorult-malware-analysis/

→https://asec.ahnlab.com/en/26517/

→https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/

→https://blog.checkpoint.com/2022/05/10/a-german-car-attack-on-german-vehicle-businesses/

→https://blog.minerva-labs.com/azorult-now-as-a-signed-google-update

→https://blog.minerva-labs.com/puffstealer-evasion-in-a-cloak-of-multiple-layers

→https://blog.nviso.eu/2020/09/01/epic-manchego-atypical-maldoc-delivery-brings-flurry-of-infostealers/

→https://blog.prevailion.com/2020/02/the-triune-threat-mastermana-returns.html

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.azorult

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Azorult