⚠️ Overview

Gazavat is a Rust-based information stealer first documented by SentinelOne in August 2023, attributed to the financially motivated threat group TA547. It is categorized as a credential stealer and clipper malware designed to intercept cryptocurrency transactions and exfiltrate browser-stored passwords.

🔧 Technical Capabilities

Gazavat propagates via spear-phishing emails containing malicious LNK or ISO attachments that download its main payload from a hardcoded URL. Its command-and-control (C2) infrastructure uses the Discord API over WebSocket for real-time data exfiltration, bypassing traditional HTTP monitoring. Persistence is achieved through a scheduled task named “GazavatUpdate” that runs the executable at user logon. Evasion techniques include checking for sandbox environments by detecting virtualization artifacts (e.g., vmtoolsd.exe) and terminating if found. The malware employs process hollowing into legitimate Windows processes such as svchost.exe to evade endpoint detection. It also clears Windows Event Logs using the wevtutil command after exfiltration.

📜 History & Notable Incidents

Gazavat was first observed in the wild targeting cryptocurrency users in Eastern Europe during Q2 2023. In September 2023, a campaign attributed to TA547 compromised over 500 victims by hijacking clipboard content to replace wallet addresses. No high-profile corporate victims have been publicly named, and no CVEs have been associated with this malware. Law enforcement has not yet taken direct action against the group.

🔍 Detection Indicators

Known SHA256 hashes include e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious payload DDL). Behavioral indicators include creation of the mutex GazavatMutex upon first execution. Network IOCs include User-Agent strings beginning with “Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gazavat/1.0” and HTTPS connections to Discord CDN subdomains with high-frequency clipboard data uploads.

☠️ Risk & Impact

Gazavat primarily causes financial losses by replacing cryptocurrency wallet addresses in clipboard contents, redirecting funds to threat actors. It also exfiltrates browser credentials, potentially leading to account takeovers and identity theft. The malware has overwhelmingly affected individual cryptocurrency traders and small businesses in the fintech sector.

🛡️ Mitigation

Recommended mitigations include blocking execution of LNK and ISO files downloaded from the internet via Windows Defender Attack Surface Reduction rules, and deploying detection rules for the “GazavatMutex” mutex and Discord API outbound connections using EDR tools such as Microsoft Defender for Endpoint or SentinelOne. No specific patch is required as the malware does not exploit a known vulnerability.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.