A Windows batch file delivering AZALEA RAT has received zero detections from 61 antivirus engines on VirusTotal, according to research published Aug. 18 by Point Wild’s Lat61 threat intelligence team.
The sample’s low detection rate was partly enabled by the way the loader was built. Rather than downloading the malware from a remote server, the batch file carried its second-stage components and encrypted payload inside its own source code.
The script also used legitimate Microsoft software to process those components. Point Wild said it copied a Microsoft .NET executable, renamed it ServiceHost.exe, and paired it with a configuration file that abused the .NET AppDomain Manager feature, causing the runtime to load an attacker DLL before the program’s normal entry point.
The signed Windows certutil.exe utility was used to decode the embedded files, after which the loader decrypted and launched the final payload.
The loader was designed to leave static scanners with fewer obvious malicious indicators to identify. The batch file did not execute successfully in Point Wild’s analysis environment, so researchers manually traced its commands and extracted the embedded payload rather than observing the full delivery chain in execution.
AZALEA RAT Is Not Tied to One Loader
Rubrik Zero Labs documented AZALEA RAT in a separate investigation published Jul. 31, where the malware arrived through a malicious Windows shortcut that used native curl to pull its next stage from a remote server, the opposite of Point Wild’s self-contained approach.
Point Wild said the differing delivery mechanisms indicate the malware does not depend on a single first-stage loader, so controls built around one delivery method may miss the same RAT arriving through another.
Both samples share configuration fingerprints, including the /api/health beacon path and a scheduled task named UpdateTask.
The RAT itself provides remote access, information theft, keylogging, hidden virtual network computing (HVNC), Active Directory discovery and modification, privilege escalation and system management.
Point Wild also identified an AzaleaControl operator panel and administration client and described AZALEA as an emerging malware-as-a-service (MaaS) offering. Rubrik, which analyzed a separate AZALEA build, counted 87 built-in command handlers.
The case sets a limit on file-based detection. A clean verdict on the first-stage file means little when the payload is embedded, encrypted and reconstructed by trusted system components, and AZALEA RAT has now surfaced behind two substantially different loaders. Behavior and downstream activity are the more reliable things to hunt.
