Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
-
submitted
15/01/2025, 22:45
General
-
Target
bawless-client.exe
-
Size
65KB
-
MD5
65381c449100b2b0f547f59c7aaa7101
-
SHA1
c49ce90432156aa8baca2732e8a087ceec8ea199
-
SHA256
bb09ed5d136789a959b1cd832b1479bb8357e22c19f47cee9e017108f277d44e
-
SHA512
68a5813ae035b2eac366985a4000e5cf716d110f256cec5150b8f80137583681aefcffd9817b8bf7625b6322f440fa6f4c3d6fe234a447c7369df02b6d5df4eb
-
SSDEEP
1536:hTn/rlEQ/l4d3ZnWSazRg9Sw1bbsZxRKoBv+asdNpqKmY7:lnF/l4BZWRyV1bbsZaoRKdWz
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Bawless Remote
Botnet
RTJLA
C2
127.0.0.1:80
Mutex
6RAWIQFXG
Attributes
-
delay
0
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bawless-client.exe"C:\Users\Admin\AppData\Local\Temp\bawless-client.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB