{
	"id": "01bc2b26-8019-4e31-87eb-b751d349b91b",
	"created_at": "2026-04-06T00:21:34.309351Z",
	"updated_at": "2026-04-10T03:21:58.995973Z",
	"deleted_at": null,
	"sha1_hash": "adc675e17af992487ba790b9b3619c012d452994",
	"title": "From Delivery To Execution: An Evasive Azorult Campaign Smuggled Through Google Sites",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 659755,
	"plain_text": "From Delivery To Execution: An Evasive Azorult Campaign\r\nSmuggled Through Google Sites\r\nBy Jan Michael Alcantara\r\nPublished: 2024-03-15 · Archived: 2026-04-05 12:50:10 UTC\r\nSummary\r\nNetskope Threat Labs has observed an evasive Azorult campaign in the wild that employs multiple defense\r\nevasion techniques from delivery through execution to fly under the defender’s radar as it steals sensitive data.\r\nAzorult is an information stealer first discovered in 2016 that steals sensitive information including user\r\ncredentials, browser information, and crypto wallet data. Azorult is on the rise and is currently one of the top\r\nmalware families that Netskope Threat Labs has observed targeting the healthcare industry over the last year.\r\nIn this blog post, Netskope Threat Labs performs a detailed teardown of an evasive AzoruIt malware campaign we\r\nobserved in the wild.  This campaign is noteworthy for the following reasons:\r\nIt delivers its initial payload through HTML smuggling, a detection evasion technique that is gaining\r\npopularity among adversaries. This defense evasion technique was also used by a nation-state group to\r\nsmuggle a remote access trojan, and by Nokoyawa ransomware, where they started the infection process\r\nthrough HTML smuggling.\r\nIt uses an unorthodox HTML smuggling technique where the malicious payload is embedded in a separate\r\nJSON file hosted on an external website.\r\nIt executes the fileless Azorult infostealer stealthily by using reflective code loading, bypassing disk-based\r\ndetection and minimizing artifacts.\r\nIt uses an AMSI bypass technique to evade being detected by a variety of host-based anti-malware\r\nproducts, including Windows Defender.\r\nIt steals sensitive data, including information for 137 distinct crypto wallets, login credentials, browser\r\nfiles, and important documents.\r\nGoogle Sites serves as a decoy for HTML smuggling\r\nHTML smuggling is a defense evasion technique that aims to bypass web controls that block risky file types. It\r\nabuses legitimate HTML5 download attributes and Javascript blobs to construct malicious payloads on the client\r\nside, bypassing network security filters. \r\nAs part of Netskope Threat Labs’ threat hunting activities, we uncovered a campaign wherein an attacker created\r\nfake Google Docs pages on Google Sites from which they used HTML smuggling to download malicious\r\npayloads. They lure their victims to the fake Google Docs pages to trick them into believing the downloaded file\r\nwas from Google Docs. In most cases that we see in the wild, the adversary embeds the smuggled malicious\r\npayload in the Javascript itself. In this example, the adversary embedded the malicious payload in a separate\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 1 of 26\n\nJSON file as a BASE64 encoded string. When the victim accesses the website, it sends a GET request to\r\ndownload the JSON file from a separate domain ( mahmudiyeresort[.]com[.]tr ) and extracts the payload from\r\nthere.\r\nHTML smuggling code that collects Payload From Compromised Domain\r\nSmuggling With A Captcha\r\nUsually, when a victim accesses a website that uses HTML smuggling to deliver malicious payloads, the payload\r\nis downloaded immediately. For this campaign, the attacker’s website hosted on Google Sites initiates a\r\nCAPTCHA, which serves as an additional layer of protection against URL scanners. This helps the HTML file to\r\nremain undetected in public scanners like Virustotal, which cannot proceed past the CAPTCHA.\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 2 of 26\n\nHTML smuggling code that collects Payload From Compromised Domain\r\nMalicious shortcut downloading multiple Powershell and Javascripts\r\nOnce the user passes the CAPTCHA test, the HTML smuggling Javascript code reconstructs the payload and\r\ndownloads it to the victim’s machine. The payload is an LNK shortcut file that uses a PDF icon to trick users into\r\nclicking it. Clicking on the LNK file kicks off the following chain of events.\r\n1. The LNK file spawns a command prompt where it saves a base64 encoded Powershell command to a batch\r\nfile named Fyap4cKJ.bat\r\n2. The Powershell command is then decoded using a Windows native application named certutil.exe and\r\noverwrites Fyap4cKJ.bat\r\n3. It then creates a scheduled task named t09pxsrXKG that executes the batch file Fyap4cKJ.bat . \r\n4. The batch file Fyap4cKJ.bat will execute a Powershell script that uses Invoke-WebRequest to download\r\na PHP file from sqjeans[.]com and saves it as qtoW0vI2.js in the temp folder. It will then execute\r\nqtoW0vI2.js using wscript.exe .\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 3 of 26\n\n5. The Powershell command from the batch file Fyap4cKJ.bat then deletes the scheduled task t09pxsrXKG\r\ncreated earlier.\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 4 of 26\n\nLNK payload with PDF icon\r\nThe Javascript qtoW0vI2.js then performs the following three tasks:\r\n1. Copies itself in the %ProgramData% , and renames itself as agent.js\r\n2. Checks and deletes itself if a file named  7z52OJFPXT4J exists in the temp folder. \r\n3. Downloads two Powershell scripts named agent1.ps1 and agent3.ps1 using Invoke-WebRequest , and\r\nexecutes them using Invoke-Expression .\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 5 of 26\n\nqtoW0vI2.js from the compromised domain\r\nAzorult Fileless Malware Loaded Through Reflective Code Loading\r\nAnother defense evasion technique the attacker uses is to execute the Azorult infostealer in memory using\r\nreflective code loading. Reflective code loading of a portable executable file means that instead of writing and\r\nrunning the malware on disk where it leaves more footprints and artifacts, it loads code into a running Powershell\r\nprocess’s own memory. Let’s look at how they accomplish reflective code loading with the two Powershell scripts\r\nexecuted.\r\nagent1.ps1\r\nThe first powershell script ( agent1.ps1 ) executed is used to bypass the Antimalware Scan Interface (AMSI). It\r\ndoes so by setting AmsiInitFailed to a True value so that AMSI initialization fails, which means no scan will\r\nbe performed for the current process.\r\nThe value of AmsiInitFailed is defined by the Javascript qtoW0vI2.js as it executes agent1.ps1 .\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 6 of 26\n\nAMSI bypass from agent1.ps1\r\nagent3.ps1\r\nThe second powershell script ( agent3.ps1 ) is set to perform the following tasks:\r\n1. Download an Azorult loader\r\nThe Powershell script ( agent3.ps1 ) starts by downloading the Azorult loader ( service.exe ) from the earlier\r\ncompromised domain using Invoke-WebRequest . The executable was likely compiled in November 2023 and\r\nwas first submitted to VirusTotal in February.\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 7 of 26\n\nAzorult Loader General Information using Detect It Easy\r\nThe loader downloaded is not actually written on disk but is later executed in an allocated memory. The binary\r\ncontent is stored as a byte array in the variable $image , and later stored in a memory block buffer $imagebBuf\r\nusing a copy function from  System.Runtime.InteropServices.Marshal . \r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 8 of 26\n\nPowershell script storing the loader into byte array and later allocated into a memory block\r\nThe loader contains some anti-analysis features where it terminates its process when it matches its list of common\r\nsandbox usernames and hostnames. The following usernames and hostnames are monitored: “Paul Jones”, “Joe\r\nCage”, “PJones”, “STRAZNJICA GRUBUTT”, “WillCarter-PC”, “FORTI-PC”.\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 9 of 26\n\nLoader terminating process based on common sandbox username and hostname\r\n2. Define a shellcode\r\nA shellcode on the byte array $sc is defined on the script. Later on, this will be executed in memory within the\r\nsame thread of the downloaded executable.\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 10 of 26\n\nShellcode loaded along with the initially loaded malware\r\n3.  Execute a routine that loads both shellcode and executable into process memory\r\nThe script defines two functions: Get-DelegateType (GDT) and Get-ProcAddr (GPA). The GDT function\r\ndefines a delegate type at runtime, while the GPA function returns a function’s memory address from a module.\r\nLater in the script, the GPA function gets the memory addresses of VirtualAlloc , CreateThread , and\r\nWaitForSingleObject from kernel32.dll .\r\nThe script then initiates memory allocation for the shellcode ( $sc ) by invoking VirtualAlloc . Subsequently,\r\nthe content of the shellcode is transferred to the allocated memory represented by variable $x using the\r\nMarshal.Copy method.\r\nAs for the Azorult loader ( service.exe ), the script employs Marshal’s AllocHGlobal method to allocate\r\nunmanaged memory, sized according to the length of the executable’s byte array ( $image ), and assigns it to\r\n$imageBuf . Subsequently, the binary content of the executable stored in $image is transferred to the allocated\r\nmemory buffer $imageBuf using the Marshal.Copy method\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 11 of 26\n\nLastly, the script uses CreateThread to initiate a new thread, providing the memory addresses of both the\r\nshellcode and the executable. It then employs WaitForSingleObject to await the completion of the thread’s\r\nexecution process.\r\nLoading of of shellcode and executable in memory\r\nsd2.ps1\r\nWhen the loader is executed, it sends an HTTP GET request to download and execute another Powershell script\r\nnamed sd2.ps1 . The script initially connects to a C2 server to collect an XOR key and store it in the $config\r\nvariable. The key is then used for a byte-wise XOR operation for the Azorult binary defined inside the script. \r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 12 of 26\n\nsd2.ps1\r\nAzorult\r\nThe Azorult payload is a .NET compiled binary named pg20.exe executed in memory using the Assembly.Load\r\nmethod. It aims to collect sensitive user information, including personal documents, crypto wallet information,\r\nlogin credentials, and browser data. All stolen files and data are then transmitted to the C2 server over HTTP.\r\nThe malware starts with a parameter check. If fewer than 2 parameters are passed, it terminates execution.\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 13 of 26\n\nParameter check with a dummy C2 server\r\nAfterward, Azorult proceeds to generate a private and public key and a shared secret. It uses Curve25519 elliptic\r\ncurve cryptography to generate a 32-byte private key, and from it generate a public key and shared secret. These\r\nare used to encrypt the stolen files to prevent detection as the stolen files get uploaded over to the C2 server.\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 14 of 26\n\nRoutine to generate private and public keys\r\nThe infostealer proceeds to collect the following data from the victim:\r\nPrimary Display Screenshot\r\nAzorult initially collects a screenshot of the device’s screen. It uses the GetDeviceCaps method to retrieve the\r\nresolution of the primary display screen. It then captures a screenshot of the entire screen using the\r\nGraphics.CopyFromScreen method, which copies the screen’s content onto a bitmap object. Finally, the captured\r\nimage is saved as a JPEG file.\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 15 of 26\n\nCode to collect screenshot\r\nBrowser Data\r\nAzorult proceeds to pilfer the victim’s browser data. It copies the content of Chrome’s Login Data, Local State,\r\nCookies, and Web data into the roaming folder path to be exfiltrated later. It uses the InternalCopy method\r\ninternally defined, using the Win32 CopyFile function to copy all the browser data.\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 16 of 26\n\nRoutine to copy Chrome’s related files\r\nThe same routine is applied to Firefox’s database files. It copies the content of several database related files and\r\nsaves it to the roaming profile path. It copies the following files: formhistory.sqlite , places.sqlite ,\r\ncookies.sqlite , logins.json , and key4.db .\r\nCrypto wallet information\r\nThe infostealer then proceeds to copy crypto wallet data from the target machine stored in Chrome, Edge, and\r\nFirefox. The malware contains a list of 119 target Chrome wallets and 12 Edge wallet extensions. It verifies if a\r\nuser has installed a Google Chrome or Edge wallet extension by checking if the wallet’s folder name from the list\r\nis present in the Local Extension directory. If the wallet directory is present, it will copy its files to the roaming\r\nprofile directory.\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 17 of 26\n\nRoutine to verify and copy Chrome’s wallet extension\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 18 of 26\n\nTarget Chrome Wallets\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 19 of 26\n\nTarget Edge Wallets\r\nSimilarly, Azorult also looks for some target wallet extensions on Firefox. It does so by collecting all Firefox\r\nextension IDs on the device and cross checking it with the target wallet list. Once the presence of the wallet\r\nextension is confirmed, it copies the contents of the file to the roaming profile path.\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 20 of 26\n\nRoutine that looks for Crypto wallet Firefox extension\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 21 of 26\n\nTarget Firefox Wallets\r\nSensitive Documents\r\nLastly, Azorult looks for sensitive documents and files on the Desktop. It searches for certain file extensions and\r\nfiles named with keywords that might contain personal sensitive information. While searching for specific files, it\r\nalso skips certain file types. \r\nTarget File Extension \r\ntxt axx doc xls\r\nkdbx docx xlsx\r\nFile Name Keywords\r\nbackup wallet ledger safepal UTC–20*\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 22 of 26\n\ntwo-fa secret trezor paper-wallet-*.png\r\nUnwanted File extension\r\nlnk js cpp d\r\nexe ts h pdb\r\ndll asm php svg\r\nobj s py wav\r\nvcxproj c pyc smali\r\nvcproj cc cs\r\nWhen all conditions are met, it reads the contents of the files and writes them to a memory stream, which is later\r\nused to exfiltrate to the C2 server.\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 23 of 26\n\nRoutine to copy the content of file\r\nAll files and data collected are sent to the server via HTTPS using the WebRequest class. The data copied are\r\ncompressed using GZip compression and then stored in an array. The array is then encrypted using the earlier\r\ncreated shared secret, then sent over to the C2 server using the WebRequest.Create method. The public key\r\ngenerated earlier will be sent over through requestStream .\r\nRoutine to exfiltrate stolen file with a dummy C2 server\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 24 of 26\n\nSample exfiltrated file\r\nConclusions\r\nAzorult is an infostealer used to steal user’s credentials and card information. In this blog, we analyzed a\r\ncampaign wherein an attacker used multiple evasion techniques, including HTML smuggling, bypassing of AMSI,\r\nand reflective code loading, to hide their activity from security controls. Unlike common smuggling files where\r\nthe blob is already inside the HTML code, this campaign copies an encoded payload from a separate compromised\r\nsite. Using legitimate domains like Google Sites can help trick the victim into believing the link is legitimate. The\r\nAzorult malware then pilfers multiple sensitive information and payment data from its target. Netskope Threat\r\nLabs will continue monitoring this and other malware campaigns used to spread infostealers.\r\nIOCs\r\nAll the IOCs related to this campaign can be found in our GitHub repository.\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 25 of 26\n\nSource: https://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nhttps://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites\r\nPage 26 of 26",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.netskope.com/blog/from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites"
	],
	"report_names": [
		"from-delivery-to-execution-an-evasive-azorult-campaign-smuggled-through-google-sites"
	],
	"threat_actors": [],
	"ts_created_at": 1775434894,
	"ts_updated_at": 1775791318,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/adc675e17af992487ba790b9b3619c012d452994.pdf",
		"text": "https://archive.orkl.eu/adc675e17af992487ba790b9b3619c012d452994.txt",
		"img": "https://archive.orkl.eu/adc675e17af992487ba790b9b3619c012d452994.jpg"
	}
}