Overview

overview

10

Static

static

1

rp99.bat

windows10-2004-x64

10

rp99.bat

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    rp99.bat
  • Size 411KB
  • Sample261022-pnzvescs6w
  • SHA256 ac8a126f786c3bc59b557a54bb71beb26e0f06433f61cdb694f8a916cbe18a85
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
azaleaitcollectiondiscoveryexecutionpersistencerat

Malware Config

Extracted

Family

  • azalea

Botnet

  • it

C2

  • 172.19.2.77:8080

Mutex

  • UpdateOrchestratorf3a8

Wallets

  • kB3qHqpSddh9aaVb8G8BqbvhPdMwS8GqNBnu

Attributes
  • amsi_patch

    true

  • av_exclusion_path

    C:\Program Files

  • beacon_interval_seconds

    156

  • beacon_path

    /api/updates

  • install

    true

  • install_path

    %UserProfile%\AppData\Roaming\mwamjw76\MicrosoftEdgeUpdate.exe

  • keylogger

    true

  • persistent_queue_path

    %Temp%\vusnhj.dat

  • registry_key

    SecurityHealthSystray

  • scheduled_task

    MicrosoftEdgeUpdateTaskCore

  • stealer

    true

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0

Targets

    • Target
      rp99.bat
    • Size 411KB
    • SHA256 ac8a126f786c3bc59b557a54bb71beb26e0f06433f61cdb694f8a916cbe18a85
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    itcollectiondiscoveryexecutionazaleapersistencerat

    • Detects Azalea RAT

    • Family: Azalea

      Azalea is a modular Windows RAT written in C#.

      ratazalea

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks