Azalea RAT: From Stealthy Loader to Full-System Control

    Monday, August 3, 2026 In: Threat Research Print

    Date: 08/03/2026

    Severity: High

    Summary

    Azalea is a sophisticated modular Remote Access Trojan (RAT) that uses a stealthy multi-stage loader, in-memory execution, and anti-analysis techniques to establish persistent access while evading detection. Its plugin-based architecture enables attackers to dynamically extend functionality, including reconnaissance, privilege escalation, keylogging, credential theft, and HVNC. The malware's flexible and extensible design makes it well-suited for long-term post-compromise operations and targeted intrusions. 

    Indicators of Compromise (IOC) List

    Domain/URLs

    http://159.100.18.98:80/fbbef44e-51f2-4f0c-be82-09a32ddbb320

    https://13.57.6.116:443/babe8d03-0088-4c34-b80d-6dc46f139d36

    Hash

    c8a64b664e9c1d50570b0c36eb05aa9b089b72c9ef452cbe1c867f7d9dd97396

    fb4705291d43caa98aab2d0c8a9f9e43d4828f4190c125624e076e20aa83d911

    3b150a9d462db8008e53401a87858e8837094dce60838b974018b36d3839383d

    1e5b9e99c5cb2abcd77ea25c29a01eb419231445ae8f525c8339bfd590c9445e

    8c1aa18255eaf5af7970b08d5744bb6d5ffc849292855a51791a5ff5d3577e60

    a0e046a4bdcdac893339cfe7284529734733fcbc89fcc6cf3f9ff5c6e8dcc69d

    af7d42a4c6e034d1631336bae5249d3a419168a7ae5909266ab5ca428e9cd21a

    5a3c1fd4f30b17f3646df47f1a452731f24bc99557fd284d0901fd6db8214b51

    4eab989c3b70f67d2c6ea1b6b69223b91ed83477ab977f256ed3171b17e8ed3a

    72fbdd7c6b1232436418baf150f35a938f96175a9481a66ab3fd09e4fed32e23

    969f20ae5263e39aa325f1db426e450d0e9cb640739e7bfedde4db5510c677e4

    7906b46976cb06e53c9e197b19508de6663f627149fd51c37a0fb516285392b2

    38ebb530958781d7a8741f78246d01ca6071ed0e2004923a6cb8f56e7f569814

    23ba1d74640db046a3340dba4cb50278d1447e30ae8f6f76c7dbac38c19487dd

    6e3a5404a187158b61ac563cbf1a3029a9a29b410fdb5a00c18bc81f1cd1e818

    b481528041e79ceeb05b3d8f5c379a9ea577716b35892a3cde3d4ae1da0edfd8

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "https://13.57.6.116:443/babe8d03-0088-4c34-b80d-6dc46f139d36" or url like "https://13.57.6.116:443/babe8d03-0088-4c34-b80d-6dc46f139d36" or siteurl like "https://13.57.6.116:443/babe8d03-0088-4c34-b80d-6dc46f139d36" or domainname like "http://159.100.18.98:80/fbbef44e-51f2-4f0c-be82-09a32ddbb320" or url like "http://159.100.18.98:80/fbbef44e-51f2-4f0c-be82-09a32ddbb320" or siteurl like "http://159.100.18.98:80/fbbef44e-51f2-4f0c-be82-09a32ddbb320"

    Detection Query 2 :

    sha256hash IN ("fb4705291d43caa98aab2d0c8a9f9e43d4828f4190c125624e076e20aa83d911","4eab989c3b70f67d2c6ea1b6b69223b91ed83477ab977f256ed3171b17e8ed3a","3b150a9d462db8008e53401a87858e8837094dce60838b974018b36d3839383d","6e3a5404a187158b61ac563cbf1a3029a9a29b410fdb5a00c18bc81f1cd1e818","b481528041e79ceeb05b3d8f5c379a9ea577716b35892a3cde3d4ae1da0edfd8","5a3c1fd4f30b17f3646df47f1a452731f24bc99557fd284d0901fd6db8214b51","7906b46976cb06e53c9e197b19508de6663f627149fd51c37a0fb516285392b2","af7d42a4c6e034d1631336bae5249d3a419168a7ae5909266ab5ca428e9cd21a","1e5b9e99c5cb2abcd77ea25c29a01eb419231445ae8f525c8339bfd590c9445e","72fbdd7c6b1232436418baf150f35a938f96175a9481a66ab3fd09e4fed32e23","23ba1d74640db046a3340dba4cb50278d1447e30ae8f6f76c7dbac38c19487dd","c8a64b664e9c1d50570b0c36eb05aa9b089b72c9ef452cbe1c867f7d9dd97396","a0e046a4bdcdac893339cfe7284529734733fcbc89fcc6cf3f9ff5c6e8dcc69d","969f20ae5263e39aa325f1db426e450d0e9cb640739e7bfedde4db5510c677e4","38ebb530958781d7a8741f78246d01ca6071ed0e2004923a6cb8f56e7f569814","8c1aa18255eaf5af7970b08d5744bb6d5ffc849292855a51791a5ff5d3577e60")

    Reference: 

    https://zerolabs.rubrik.com/blog/azalea-rat-stealthy-loader-full-system-control       


    Tags

    MalwareRATLoaderStealerCredential HarvestingHVNCKeylogger

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.