![Trend Micro Security](https://www.trendmicro.com/content/dam/trendmicro/global/en/global/logo/logo-desktop.png)
Spam Campaign Leads to Azorult Trojan Spyware
2018年8月22日
![](https://documents.trendmicro.com/images/Spam01-08212018.jpg)
Similar to EMOTET’s arrival, Trojan spyware Azurolt has been spotted coming in the form of a spoofed bank notification. The spam campaign is making the rounds in Germany and UK.
The email prompts the user to download a doc file using the malicious link different from what is displayed:
![](https://documents.trendmicro.com/images/Spam02-08212018.jpg)
The URL downloads from a fake db.com site:
![](https://documents.trendmicro.com/images/Spam03-08212018.jpg)
Then redirects to the real db.com:
![](https://documents.trendmicro.com/images/Spam04-08212018.jpg)
![](https://documents.trendmicro.com/images/Spam05-08212018.jpg)
Once the user enables the macro (detected as W2KM_POWLOAD.NSFGAIBA), it downloads the Godzilla loader (detected as TROJ_ZIGDOLL.A) from the fake db.com site via PowerShell. It then downloads the Azurolt malware (detected as TSPY_AZORULT.A), designed to steal information.
スパムブロック日時 : 2018年8月22日 22:00:00 GMT-8
TMASE
- TMASEエンジン:8.0
- TMASEパターンバージョン:4048