AZORult is remote access trojan popular on Russian forums and most recently spotted last month in a spam campaign perpetrated by a hacker with an affinity toward singer-songwriter Drake. The malware-laced messages are fairly uninteresting and consist of a standard phishing hook. However, the attacker s use of three layers of encryption could present a challenge for signature and heuristics-based detection tools. The payload uses a novel obfuscation technique to slip past antivirus detection.
Source: https://threatpost.com/azorult-campaign-encryption-technique/152508/