AZALEA RAT Delivered Through a Stealthy Batch Script

Summary

AZALEA RAT is an emerging Malware-as-a-Service (MaaS) remote access trojan distributed through underground cybercriminal communities. The malware offers extensive capabilities, including credential theft, keylogging, and Active Directory enumeration. It relies on sophisticated multi-stage loaders and abuse of legitimate system processes to evade detection.

Investigation

Researchers identified a highly evasive Windows batch file that achieved a 0/61 detection score on VirusTotal. The investigation uncovered a chain involving .NET AppDomain Manager hijacking, certutil.exe for decoding, and AES-256-CBC decryption of the final payload. The loader also minimizes forensic artifacts through self-deletion and components that execute only in memory.

Mitigation

Organizations should monitor for unusual execution chains involving legitimate binaries such as certutil.exe, jsc.exe, and csc.exe. Robust endpoint detection and response (EDR) should be configured to identify AppDomain Manager hijacking and unauthorized registry changes. Users should also be trained to avoid suspicious attachments delivered in ZIP or RAR archives.

Response

If AZALEA RAT activity is detected, the affected host should be isolated immediately to limit lateral movement and credential theft. Responders should perform memory forensics to recover the decrypted payload and inspect scheduled tasks or registry locations for persistence. Network logs should also be reviewed for suspicious connections over non-standard ports such as 1150.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to deliver the AZALEA RAT using a multi-stage loading process. To evade simple signature-based detection, the attacker uses a batch script to download or drop a legitimate .NET executable and renames it to ServiceHost.exe to blend in with system services. They then use certutil.exe, a built-in Windows utility, to decode an embedded malicious payload. The goal is to achieve execution of the RAT component via Process.Start() within a script, masquerading as a routine service operation.

• Regression Test Script:

  # AZALEA RAT Simulation Script
  # 1. Setup: Create a fake encoded payload (Base64 for 'malicious_payload')
  $payload = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("malicious_payload_content"))
  $payload | Out-File -FilePath "$env:TEMPencoded.txt"
  
  # 2. Simulate 'ServiceHost.exe' creation by copying a system tool and renaming it
  $targetDir = "$env:USERPROFILEAppDataLocalTempServiceFolder"
  New-Item -ItemType Directory -Force -Path $targetDir
  Copy-Item "C:WindowsSystem32cmd.exe" -Destination "$targetDirServiceHost.exe"
  
  # 3. Simulate Certutil decoding (Triggers Rule)
  Start-Process "certutil.exe" -ArgumentList "-decode $env:TEMPencoded.txt $env:TEMPdecoded.exe" -Wait
  
  # 4. Simulate execution of the renamed host (Triggers Rule)
  Start-Process "$targetDirServiceHost.exe" -ArgumentList "/c echo RAT Active"

• Cleanup Commands:

  # Cleanup simulation artifacts
  Remove-Item -Path "$env:TEMPencoded.txt" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPdecoded.exe" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:USERPROFILEAppDataLocalTempServiceFolder" -Recurse -Force -ErrorAction SilentlyContinue