Gazorp, a free malware builder spotted on the dark web, lets would-be threat actors create customized AZORult attacks.

First discovered by Check Point Research on Sept. 17, the new builder makes it easy to generate custom samples of the AZORult infostealer. According to Gazorp’s creators, developing malware with the tool is “as simple as 2×2”: Prospective users provide their command-and-control (C&C) address, download the malware builder, install the panel and deploy their new creation in the wild.

Gazorp builds samples of AZORult version 3.0, which was released five months ago. Since that time, two newer versions — 3.1 and 3.2 — have been released, limiting the efficacy of Gazorp’s version. As Check Point made clear, however, the outdated version has “multiple stealing capabilities which can be leveraged by any actor to gather victim information and misuse it.”

Gazorp’s Expanding Threat Capabilities

Gazorp’s authors have added several new panel features and code upgrades to boost the impact of their AZORult version. Notable improvements include the addition of a global heat map that provides country-by-country statistics and the ability to create a complex mutex based on multiple factors, including admin, user, system and guest authorities. In addition, this Gazorp version includes vulnerability and bug fixes to version 3.0, along with visual user interface (UI) enhancements.

But that’s not all. The malware builder also includes a Telegram channel link that features the ongoing work of Gazorp’s authors. Users who visit the channel can get updates on new features, add their own suggestions and donate bitcoin to help drive future improvements. The creators made it clear: “More donations, more updates.” According to Check Point, it appears the project will evolve over time and “possibly produce new variants for AZORult.”

How to Protect Enterprise Data From a Malware Builder

Tackling the problem of custom malware code starts with consistent patching. Security experts note that “the bulk of security issues simply come down to software patching,” and this is certainly the case with Gazorp. Given its use of outdated AZORult code, regular security patching will frustrate most free-to-play malware attackers.

Security teams should also consider investing in security-as-a-service (SECaaS) solutions. Check Point noted that new Gazorp attacks may begin to emerge at a higher scale as more attackers discover the service. Attempting to track evolving, emerging infections without the benefit of on-demand security resources quickly becomes an exercise in frustration — and could lead to network compromise.

Source: Check Point Research