Azoralt Trojan

The Azoralt Trojan is spyware that collects information, such as passwords, from your computer. Some versions of this threat are installing themselves through a fake system cleaner: G-Cleaner or Garbage Cleaner. Users can keep themselves safe by scanning downloads with appropriate security services and letting their anti-malware tools remove the Azoralt Trojan automatically upon any detection.

A Little Extra Garbage with Your Cleaner

The concept of digital janitorship is one that's a favorite for both legitimate freeware like CCleaner, as well as hoaxes like the 'PCRegFixer Registry Cleaner' Tech SupportScam and rogue software like Security Cleaner Pro. Most of the threatening versions of such software will settle for attacks such as misrepresenting your computer's state of health while promoting their premium versions. However, a recent incident publicized by security researchers over Twitter is showing the delivery method for something worse than a slovenly cleaner: the Azoralt Trojan.

While the Azoralt Trojan is most notorious for being a password collector, its spyware features encompass the exfiltration of other data types, invariably, confidential ones like credit card numbers and other credentials. The Windows Trojan is being installed by multiple means, but most recently, through the G-Cleaner: a fake junk file remover and Registry-optimization tool. G-Cleaner's tactic includes a host website that's similarly-built to the domains of authentic cleaner utilities, as well as a working UI that displays features related to disk optimization and similar stats.

Sadly, G-Cleaner doesn't include system-cleaning features, only the outer mimicry of them. Its real purpose is serving as the Azoralt Trojan's Trojan dropper. It drops and runs the Azoralt Trojan automatically, which harvests information, ZIPs it, and transfers it to a Command & Control server. As of malware experts' last checks, the site, and its payload, still, are operational.

Taking Out the Spyware Trash

The Azoralt Trojan's latest venture in infecting Windows users offers an exemplary model for how victims compromise their systems without thinking about the consequences. Always verify the authenticity of a website before trusting its downloads, concerning free software with themes like pop-up blockers, browser protectors, or disk cleaners especially. Additionally, malware experts note that most junk file optimization tools have limited success rates versus optimizing performance to any significant degree.

Azoralt Trojan infections will endanger your privacy by harvesting information without providing symptoms during the attacks immediately. Users should disable network connections ASAP after infections, for limiting any communications that the Trojan may make with its C&C. Otherwise, let your anti-malware products handle uninstalling the Azoralt Trojan and change all passwords afterward.

There's little quality-of-life in cleaning out a few unnecessary Registry entries, browser cookies or unwanted files. However, there's a lot to lose by trusting strangers' downloads onto your computer, as the Azoralt Trojan is showing.