Who plays on AZORult? An unknown attacker collects various data and spreads additional payloads with AZORult for around 5 years

Thursday 3 October 14:00 - 14:30, Red room

Masaki Kasuya (BlackBerry)

In the cybersecurity space, security practitioners and researchers try to analyse malware based on deep-dive analysis and short-term trend research, and we use those results to understand each malware behaviour and attack trend. In contrast with that, we rarely look at long-term trends, which usually provide us with interesting insights. For example, a single attacker uses a malware family's bot network to spread additional payload and/or steal sensitive information for a long time. Unfortunately, the C2 server does not send any response if we send invalid data, and C2 communication tends to be encrypted. Unless we understand the whole procedure of C2 communication, we cannot track C2 infrastructure for long-term analysis.

As a case study, this paper presents the results of long-term analysis of AZORult. AZORult is known as an information stealer, first analysed in 2016, and we started to track its C2 servers in January 2019. To this end, we implemented AZORult emulator, which allows us to get a valid data blob which contains commands from the AZORult C2 server. Overall, it has shown shrinkage in its activity recently. However, we revealed that an unknown attacker has been using AZORult's bot network to spread additional payloads and steal sensitive information for around five years. Based on our analysis, the attacker has stolen information mainly related to cryptocurrency, password managers and multi-factor authentication since it appeared. In addition to this, the attacker spread additional payloads via AZORult twice: from November 2019 to March 2020 and from June 2020 to March 2022. During the second additional payload spreading campaign, we found that the attacker spread the same additional payloads with the same URL on AZORult and Raccoon bot networks. This result shows an attacker can use the same bot network for a long time and a different bot network to spread the same malware samples.

Masaki Kasuya Masaki Kasuya is a principal security researcher in BlackBerry Threat Research Investigation. His recent interest is in understanding malware ecosystems. To this end, he focuses on fully revealing C2 protocols with his reverse engineering techniques and re-implementing the algorithm to collect additional payloads from the C2 server. He has implemented custom emulators of Panda Banker, AZORult, Amadey, Emotet, Trickbot, Raccon, Kpot, Vidar, Buer, Taurus, Qbot, IcedID, Redline, SmokeLoader, PrivateLoader and RisePro. He earned his Ph.D. with a dissertation that sought how to stimulate stealthy malware behaviour. @Blayze_PhD masaki-kasuya-ph-d-016084a6

Back to VB2024 Programme page

Back to VB2024 conference page

Register for VB2024

Other VB2024 papers