Overview

overview

10

Static

static

3

setup.exe

windows10-2004-x64

10

setup.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    setup.exe
  • Size 93KB
  • Sample261031-alyf9af12y
  • SHA256 52e7f3cf0136b25a44525c41d482a6d12060baa2c5ad615fd8e21c310c20146d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
azaleaitdefense_evasiondiscoveryratspywaretrojan

Malware Config

Extracted

Family

  • azalea

Botnet

  • it

C2

  • 198.19.248.16:8080

Mutex

  • UpdateOrchestratore3a8

Wallets

  • xEbpdVpGMv3CnnKbLuSFmviqRV

  • EgkPRvdXmtxfZYaKeLasR8xnUbH3WmP8ZA3f

Attributes
  • amsi_patch

    true

  • av_exclusion_path

    C:\Windows\Temp

  • beacon_interval_seconds

    57

  • beacon_path

    /api/telemetry

  • install

    true

  • install_path

    %UserProfile%\AppData\Roaming\qpaamv8\MicrosoftEdgeUpdate.exe

  • persistent_queue_path

    %Temp%\ossqhn.dat

  • registry_key

    SecurityHealthSystray

  • scheduled_task

    MicrosoftEdgeUpdateTaskCore

  • uac_bypass

    true

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36

Targets

    • Target
      setup.exe
    • Size 93KB
    • SHA256 52e7f3cf0136b25a44525c41d482a6d12060baa2c5ad615fd8e21c310c20146d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    itdefense_evasiondiscoveryazalearatspywaretrojan

    • Detects Azalea RAT

    • Family: Azalea

      Azalea is a modular Windows RAT written in C#.

      ratazalea

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks