Skip to main content

AZORult trojan disguised as Google update installer steals credentials




  • AZORult hides as a Google Updater program and replaces the legitimate Google Updater program on the compromised systems.
  • As the malware replaces the legitimate Google Updater program, it can achieve persistency without having to alter Windows registry or add any scheduled tasks on its own.
Researchers from Minerva Labs, Asaf Aprozper and Gal Bitensky, detected the malware after they received a GoogleUpdate.exe binary signed with a valid certificate which was blocked by their security tool.
Fake Google Update binary
The researchers noted that the Google Updater program appeared to be legitimate, having the right icon and being signed with a non-revoked certificate.
However, upon closer inspection, the researchers found that the binary was actually signed with a certificate issued to ‘Singh Agile Content Design Limited’ instead of Google. This certificate was issued on November 19, 2019, and it has been used to sign over hundreds of fake GoogleUpdate executable binaries.
After in-depth analysis, the researchers uncovered that AZORult trojan was contained within the fake Google Update binary based on the following patterns,
  • Making a HTTP POST request to a /index.php
  • Using a .bit domain
  • Employing the Mozilla/4.0 User-Agent that all Azorult infections use
The researchers confirmed their findings and conclusion using the malware analysis results from Intezer and VirusTotal.
Persistence capabilities
As the malware disguises as a Google Updater program, it can run with administrator privileges and can achieve persistency using a highly stealthier mechanism. Moreover, since the malware replaces the legitimate Google Updater program, it can achieve persistency without having to alter the Windows registry or add any scheduled tasks on its own.
“This AZORult variant does not modify either the tasks or the registry. However, as the result of replacing the original GoogleUpdate.exe file, the malware will run with administrative privileges whenever an update is started. This also allows the malware to gain persistence that can be difficult to notice since the tasks and services are not suspicious–only the contents of the file they run,” researchers at Minerva Labs explained in a blog.
Researchers further noted that this is the first time AZORult has been associated with such a technique which disguises malware as a legitimate program.

Global Locations

  • Block A, A-25, Second Floor, Sector 3
    Noida, Uttar Pradesh
    +91-120 429 1672+91 931 991 8771
info@redsecurium.org redsecurium

Comments

Popular posts from this blog

Digital Marketing Services in noida

Red Securium Company Provide Digital Marketing Service In Noida Strengthen your brand positioning, awareness, revenue objectives and market share with our custom-built digital marketing services to suit their business needs. Get easily accessible to your target audience on mobiles and social networking sites across different platforms. Our cross-functional digital marketing experts offer end-to-end digital marketing solutions that are in step with your business's goals and policies. Our targeted digital marketing campaigns are custom-structured for helping you in strengthening your brand positioning, awareness, revenue objectives and market share. Digital Marketing Services  Digital Marketing Service  Social Network Marketing Service Seo Services Marketing  PPC Marketing Service  Social Media Marketing Sales Generation Services  Mobile Marketing Service  Content Marketing Service Event Marketing Service  Vide...

How To Access Notorious Dark Web Anonymously (10 Step Guide)

Are you trying to find out  how to access the dark web  and what is it? Well, look no further, we have gone and done the research so we could show you step by step the best and safest way how to access the dark net. We cover everything, from setting up Tor, how to choose a VPN , what not to do, finding the best sites to access, and extra steps to remain anonymous. It is extremely easy to access the dark web and even easier to be detected on it if you don’t take precautions. If you are new to the darknet, this guide will help you on your way. According to researchers, only 4% of the internet is visible to the general public. Meaning that the remaining 96% of the internet is made up of “The Deep Web”. Dark Web or Dark Net  is a subset of the  Deep Web  where there are sites that sell drugs, hacking software, counterfeit money and more. We explain this further down the article if you are not up to speed. If you are looking to access hidden marketpl...

Private data of almost 14,200 patients diagnosed with HIV leaked online

  The affected individuals included 14,200 individuals who had been diagnosed with HIV, of which 5,400 individuals were Singaporeans and 8,800 were foreigners. The leaked information included names, identification numbers, phone numbers, addresses, HIV test results, and other related medical information. Private data of almost 14,200 individuals who had been diagnosed with HIV up to January 2013 were leaked online. A US citizen residing in Singapore gained unauthorized access to the HIV registry and leaked the data online . Out of the 14,200 affected individuals, 5400 individuals were Singaporeans and 8,800 were foreigners. The leaked information included names, identification numbers, phone numbers, addresses, HIV test results, and other related medical information. US citizen gained illegal access to the HIV registry On 28, January 2019, Singapore's Ministry of Health confirmed in a  statement , that Mikhy K Farrera Brochez, a US citizen residing in Singapo...