AZALEA RAT Batch Loader Evades 61 VirusTotal Engines

The immediate operational concern is not that a batch file has become inherently dangerous. It is that this chain turns several ordinary Windows components into stages of a loader, leaving security tools to connect the behavior rather than identify a single malicious executable. Organizations should hunt for the sequence now, particularly on endpoints where archive attachments can be opened from Downloads, Temp, or user-profile directories.

SOC Prime is the only outlet located reporting the specific batch-loader sample and its reported command-and-control use of port 1150. Independent research by Rubrik Zero Labs has separately documented AZALEA as a modular .NET RAT with credential theft, keylogging, persistence, privilege-escalation features, Active Directory functions, and in-memory execution. That corroborates the broader risk posed by the malware family, but it does not independently confirm that Rubrik’s observed delivery chain and SOC Prime’s batch-loader chain are the same campaign or sample set.

The batch file is the start of the investigation​

The reported loader begins as a Windows batch script, a format that can look deceptively mundane in mail gateways and endpoint telemetry. Batch files are often viewed as administrative glue: they set variables, invoke utilities, and launch other programs. In this case, that flexibility is the point. The script can prepare files, decode content, compile or execute managed code, and clean up the evidence without delivering a conventional, plainly malicious PE file as the first stage.

SOC Prime says the chain uses certutil.exe to decode content. certutil.exe is a legitimate Windows certificate-management utility, so an alert that simply says “certutil ran” is almost guaranteed to generate noise in some environments. The detection value comes from its context: a batch file from a user-writable location spawning certutil.exe, which writes decoded material into Temp or AppData and is followed by scripting or .NET compilation activity, is far more concerning than certificate maintenance run by an approved administrator.

The same applies to jsc.exe and csc.exe, which are legitimate .NET compilation tools. Development work, build agents, and older enterprise applications can have valid reasons to invoke them. A user workstation opening a ZIP or RAR attachment and then generating managed code from a temporary directory is a different pattern. Security teams should record the full process tree, command line, parent path, child paths, user identity, signing state, and network activity rather than relying on a blocklist of filenames.

SOC Prime says the batch loader self-deletes and keeps portions of its operation in memory. That changes the incident-response priority: collecting only files from disk may leave responders with the initial script but not the decrypted payload that matters most.

AppDomain Manager behavior deserves its own alert​

The most useful technical detail in the report is the alleged abuse of .NET AppDomain Manager behavior. Microsoft’s .NET Framework documentation describes AppDomainManager as a component that can participate in creation of application domains. It can be designated through the APPDOMAIN_MANAGER_ASM and APPDOMAIN_MANAGER_TYPE environment variables, or through .NET application configuration.

Those settings exist for legitimate hosting and customization scenarios. They should nevertheless be rare on ordinary desktops, especially if they appear immediately before a managed application launches from a temporary or user-profile path. The practical detection problem is therefore not merely “watch for registry changes,” but “watch for a process establishing a managed-runtime loading path and then launching an unfamiliar .NET binary or compiler.”

Administrators should add telemetry or analytic coverage for:

• Creation, modification, or deletion of the APPDOMAIN_MANAGER_ASM and APPDOMAIN_MANAGER_TYPE environment variables, particularly when the assigned assembly resides outside approved application directories.
• .NET application configuration files that add appDomainManagerAssembly or appDomainManagerType settings beside executables in Downloads, Temp, AppData, ProgramData, or shared network locations.
• A command shell, batch file, or archive-extracted file spawning certutil.exe, csc.exe, or jsc.exe within a short time window.
• Managed processes loading unsigned or newly created assemblies from user-writable paths, followed by network connections or child-process creation.

This is a case where broad monitoring matters more than a single indicator. AppDomain Manager configuration can be legitimate; compiling managed code can be legitimate; decoding data can be legitimate. The combination, the location, and the parent process are what make the activity actionable.

AZALEA’s reported feature set raises the stakes after execution​

SOC Prime describes AZALEA as a malware-as-a-service remote-access trojan marketed in cybercriminal circles, with credential theft, keylogging, and Active Directory enumeration among its capabilities. Rubrik Zero Labs’ July analysis of another AZALEA infection path provides substantial technical context: it found a .NET agent with 87 command handlers, browser-data theft, persistence options using Registry Run keys and scheduled tasks, screen streaming, token-related functions, Active Directory operations, and support for loading components directly in memory.

For Windows administrators, Active Directory functionality is the dividing line between a compromised endpoint and a potential domain incident. A RAT’s ability to inspect or modify directory objects depends on the permissions available to the compromised user or process; it does not magically grant domain-admin rights. But a workstation belonging to an administrator, help-desk operator, developer with delegated rights, or service-account user can offer far more opportunity for reconnaissance and privilege abuse than a standard endpoint.

Rubrik’s analysis also documented an AZALEA sample that used different initial access mechanics: a malicious .lnk file invoked cmd.exe, which used Windows curl to retrieve an executable loader. That report found Defender-exclusion attempts, Registry staging of encrypted data, in-memory .NET assembly loading, anti-analysis checks, and multiple persistence options. The difference between that LNK-led chain and SOC Prime’s batch-led chain is important. Defenders should avoid writing a detection that assumes one exact starting file type represents all AZALEA activity.

The practical conclusion is straightforward: hunt the loader behaviors, but scope the response around the RAT’s post-compromise capabilities. A machine that ran the reported batch chain should be treated as a credential-access and lateral-movement risk until evidence shows otherwise.

What to do when the chain appears​

If the sequence is detected, isolate the host before beginning extensive local cleanup. Cutting the endpoint off from internal and external networks limits the value of an interactive RAT while preserving volatile evidence. Do not assume deleting the batch file resolves the incident; SOC Prime reports self-deletion and memory-resident components, while Rubrik’s separate analysis documented Registry-staged encrypted payloads and persistence mechanisms.

Preserve a memory image early if the organization has the capability. The decrypted final payload, loaded .NET assemblies, command-and-control configuration, active connections, and strings that never reached disk may be recoverable there. Then collect process-creation events, PowerShell and script logs where available, Windows Defender operational logs, archive-origin metadata, and endpoint telemetry covering the initial execution window.

Investigators should specifically review:

• The downloaded or attached ZIP and RAR files, their contents, and the email, browser download, chat transfer, or shared-drive event that introduced them.
• Process trees linking cmd.exe or a .bat or .cmd file to certutil.exe, jsc.exe, csc.exe, and any new executable or managed process.
• Recent changes under common persistence locations, including HKCU and HKLM Run keys, Explorer Policies Run keys, scheduled tasks, Startup folders, and unusual Registry values in user-writable contexts.
• New outbound connections from the affected account or host, with particular attention to non-standard destination ports; SOC Prime specifically identifies port 1150 in its reported AZALEA activity.
• Evidence of browser credential access, keylogging, Active Directory queries, remote desktop capture, process injection, or new local administrators.

Resetting credentials should follow the evidence, not precede it blindly. If the affected user held privileged access or the host handled administrative sessions, begin with those accounts and review authentication activity for use from other endpoints. If the endpoint was a jump box, domain-management workstation, or developer system with access to production secrets, widen the scope immediately.

Detection needs to follow behavior, not utility names​

The reported 0-of-61 VirusTotal result is a reminder that a low static-detection score measures a file’s visibility to a particular set of engines at a particular moment; it is not proof that an endpoint has no defensive coverage. It does, however, show why signature-only controls can fail when a loader is assembled from a script, native utilities, encrypted data, and a final in-memory payload.

The best immediate defensive move is to build a behavioral analytic around archive-originated scripts and suspicious process ancestry. Where business requirements permit, restrict execution of .bat, .cmd, .js, and compiler tools from Downloads, Temp, AppData, and other user-writable paths. Application-control policies should allow approved development and build workflows by trusted path, publisher, or managed deployment channel rather than giving every interactive user unrestricted access to compiler binaries.

The batch file is the visible entry point, but the key investigative artifact is the relationship between the shell, certutil.exe, .NET loading configuration, compiler activity, and the outbound connection that follows. Capturing that chain gives defenders a chance to identify AZALEA before its operators can turn a single Windows endpoint into a source of credentials, directory intelligence, and persistent remote access.