AZORult Tracker

#AZORult Tracker is now publicly available! azorult-tracker.net It's centralizing AZORult C2 panels and monitoring them for threat hunting and statistics purpose 🦅 Happy hunting!

For those who are curious about how Azorult Tracker works, @DrStache_ and @b0oml had the opportunity to present the project at the #hitchhack2021 organized by @hack2g2. The replay is available (it's in French 🇫🇷). youtube.com/watch?v=h8SJ5R…

Plain text format has been added to the "list" endpoints of the API. There are also two new feeders, MalwareBazaar and URLhaus from @abuse_ch 🎉 azorult-tracker.net/api/list/ip?fo… azorult-tracker.net/api/list/domai… azorult-tracker.net/api/list/loade…

@luc4m @makflwana @VK_Intel @James_inthe_box @malwrhunterteam @MalwareTechBlog Statistics on victims can only be made when we have access to the guest.php page, which reduces representativeness, moreover hacked panels are not counted, because of the inconsistent data being injected. The majority of the RU victims are from a single C2 azorult-tracker.net/panel/5e05e865…

Interesting.. According to @AZORult_Tracker a big part of #azorult victims are RU and infrastructure are mainly hosted in US. CC @makflwana @VK_Intel @James_inthe_box @malwrhunterteam @MalwareTechBlog

@baberpervez2 @abuse_ch The vocation of the tracker isn't AZORult binaries, but only C2 panels. Most of the time, we don't know the URLs serving the malicious binaries, however, we do get the second stage URLs, if any. They will be sent to URLhaus via the API in the near future :)

As @abuse_ch mentioned, strongly reccomend you integrate your results (via API) or complete manual ingestion of entries into #URLhaus which is being ingested by many members of the InfoSec community. This would strongly streamline your work. Super appreciated!

@abuse_ch Loaders specific endpoints have been added to the API. azorult-tracker.net/api/list/loade… Don't hesitate if you have other needs :)

@abuse_ch There isn't yet a specific endpoint on the API, but you can still get them from azorult-tracker.net/api/ We will add the endpoint soon :)

#AZORult Tracker is now publicly available! azorult-tracker.net It's centralizing AZORult C2 panels and monitoring them for threat hunting and statistics purpose 🦅 Happy hunting!

AZORult Tracker present at the botconf, DM open to meet us ! #AZORult #botconf2019