General

  • Target

    Bawless Windows Cracked By Vidhayakji786.rar

  • Size

    102.1MB

  • Sample

    241214-y5c7esvmaj

  • MD5

    99a1d2a905676cf0542c2a4d45e58d46

  • SHA1

    35fac87f8ca98865b6dee79023fb1c55cb925f0d

  • SHA256

    1801c0278583e34f09b0a202c83afbc6f2bb97ab0acb2932057a25e5eba597a6

  • SHA512

    3b1027101ef2d18a83aabd399c5ae3432b30f9ce541635ed35d1708864c55f94054b013e1c19e5b681838698067c8d6d722c3f9cf4c8b74c5c4ea8be40da8737

  • SSDEEP

    3145728:lp5yB7PXOvhxn3VGFEWDE6YorqEU+vhI9C:lpIB7PevhVVGbw5oex9C

Malware Config

Extracted

Family

asyncrat

Version

Bawless Remote

Botnet

USGR6

C2

127.0.0.1:15

Mutex

7OZIOLO37

Attributes
  • delay

    0

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Bawless Windows Cracked By Vidhayakji786.rar

    • Size

      102.1MB

    • MD5

      99a1d2a905676cf0542c2a4d45e58d46

    • SHA1

      35fac87f8ca98865b6dee79023fb1c55cb925f0d

    • SHA256

      1801c0278583e34f09b0a202c83afbc6f2bb97ab0acb2932057a25e5eba597a6

    • SHA512

      3b1027101ef2d18a83aabd399c5ae3432b30f9ce541635ed35d1708864c55f94054b013e1c19e5b681838698067c8d6d722c3f9cf4c8b74c5c4ea8be40da8737

    • SSDEEP

      3145728:lp5yB7PXOvhxn3VGFEWDE6YorqEU+vhI9C:lpIB7PevhVVGbw5oex9C

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Looks for VirtualBox Guest Additions in registry

    • Looks for VMWare Tools registry key

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

MITRE ATT&CK Enterprise v15

Tasks