{
  "Name": "AweRay",
  "Category": "RMM",
  "Description": "AweRay is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "",
  "Created": "2024-08-02",
  "LastModified": "2025-12-14",
  "Details": {
    "Website": "https://awesun.aweray.com/en",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "aweray_remote*.exe",
      "AweSun.exe"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "asapi*.aweray.net",
          "client-api.aweray.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/aweray_network_sigma.yml",
      "Description": "Detects potential network activity of AweRay RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/aweray_processes_sigma.yml",
      "Description": "Detects potential processes activity of AweRay RMM tool"
    }
  ],
  "References": [
    "https://sun.aweray.com/help"
  ],
  "Acknowledgement": [],
  "CodeSigning": {
    "search_names": [],
    "company_names": [],
    "signer_names": [
      "DUC FABULOUS CO.,LTD"
    ],
    "certificates": [
      {
        "signer_name": "DUC FABULOUS CO.,LTD",
        "certificate_thumbprint": "2C1D12F8BBE0827400A8440AF74FFFA8DCC8097C",
        "tbs_sha256": "E745D44D154427FA248F601B5C094ACFF07D4D3AB678D5EDB26899FD9114AD46",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIFpzCCA4+gAwIBAgIQbdLjFzmV9Rv6wdn7TLIAwTANBgkqhkiG9w0BAQsFADB7MQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hvdXN0b24xETAPBgNVBAoMCFNTTCBDb3JwMTcwNQYDVQQDDC5TU0wuY29tIEVWIENvZGUgU2lnbmluZyBJbnRlcm1lZGlhdGUgQ0EgUlNBIFIzMB4XDTI0MDcwNDA0MzUzMloXDTI3MDUxNTE1MTUwNFowgaQxCzAJBgNVBAYTAlZOMQ4wDAYDVQQHDAVIYW5vaTEdMBsGA1UECgwURFVDIEZBQlVMT1VTIENPLixMVEQxEzARBgNVBAUTCjAxMDU4Mzg0MDkxHTAbBgNVBAMMFERVQyBGQUJVTE9VUyBDTy4sTFREMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjETMBEGCysGAQQBgjc8AgEDEwJWTjB2MBAGByqGSM49AgEGBSuBBAAiA2IABC/mVjb9UgdRWMq3nmRrYGMv2ywk4C8+LmdZVMN453wtViJ4dWh+LMHxI1VRzC8k4wRFoR4lLJ+HSeasLd/IN1VjANU42jcLckPkJsFmRS/gJIyZ+1+s9q7iCQFHEeCn2aOCAakwggGlMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUNr1J/zEs669qQP6ZwBbtuvxI3V8wfQYIKwYBBQUHAQEEcTBvMEsGCCsGAQUFBzAChj9odHRwOi8vY2VydC5zc2wuY29tL1NTTGNvbS1TdWJDQS1FVi1Db2RlU2lnbmluZy1SU0EtNDA5Ni1SMy5jZXIwIAYIKwYBBQUHMAGGFGh0dHA6Ly9vY3Nwcy5zc2wuY29tMF8GA1UdIARYMFYwBwYFZ4EMAQMwDQYLKoRoAYb2dwIFAQcwPAYMKwYBBAGCqTABAwMCMCwwKgYIKwYBBQUHAgEWHmh0dHBzOi8vd3d3LnNzbC5jb20vcmVwb3NpdG9yeTATBgNVHSUEDDAKBggrBgEFBQcDAzBQBgNVHR8ESTBHMEWgQ6BBhj9odHRwOi8vY3Jscy5zc2wuY29tL1NTTGNvbS1TdWJDQS1FVi1Db2RlU2lnbmluZy1SU0EtNDA5Ni1SMy5jcmwwHQYDVR0OBBYEFBFUh+U2pbSNNP3NVnIF+FRcFWRcMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAgEAINp7VfTLYt9iWMRhOL2mIs5Avtwe0pGU+VvE4rnaKb8KA/EHzhEPYiWygoj9WN6MXraBgHk3caSP5f/mdT/HkpzX17Zy9yHiAcDKcuIte8AkhS7IK6b5IQU7r8eFUP6BptStrY9xNJADpgcO0EmBDoeeIpGRFKpE6cerSOJaoxxjgLxMGyUfrr39I6v/b7doJYlWXk0ki98hZNsCZ9GTKEsYoU4ek2YU3tgIR0BIfyuVoDQ8dy41P5AUVSVS2FAWRHcT88WkNpZLI78pgUBCmrjfQsT0TTyfNf0WwiAfMqf4ACS6TXyFKBk6wbbbkSPPOiodRjEAizL+LtEchnm1/2mre0Oe7P5bnYohI/6XwIvQxmoeV+uV3/Zo6TaSk6wUJQ2WKrooIoVxkiuDm5WXKZamr9jS+5yzdNKM+Frvnde8iS5HObIDBcDmEUWcHWOVuCwd/xVU7XStncpz9JEWgcILn8Pwnn/V5fdI7TV6G+ddrfECPowxFBvji+GpUEZWM3jz6tsp9iFDbnPHSKLbifn43rU0LdeEFXllF0GDIE3yrWuvYLfiPUmIZwZspL02hFhRuZgVe5jX1xKujU5o/LU76qcN4Ts6b7Lyw8IaYM1LKsvmh9bNxsqdIKXuNH+JbBN90mcA7x0auYSw9fD6iYbHY4wmiq/hCreMsysm+OU="
      },
      {
        "signer_name": "DUC FABULOUS CO.,LTD",
        "certificate_thumbprint": "1C8854BCA4E9E8249979957000414E9BBB8DBBEC",
        "tbs_sha256": "8D5708904EE6AA475A0928A7043E0E0D2B0DC31F559A3DF4FA345763831DC70C",
        "tbs_sha1": "",
        "certificate_der_base64": "MIIFJTCCBA2gAwIBAgIRAP+xO9fCfIqB7B05Wzte/fMwDQYJKoZIhvcNAQELBQAwfDELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMSQwIgYDVQQDExtTZWN0aWdvIFJTQSBDb2RlIFNpZ25pbmcgQ0EwHhcNMjAwMjE0MDAwMDAwWhcNMjEwMjEzMjM1OTU5WjCBlTELMAkGA1UEBhMCVk4xDzANBgNVBBEMBjEwMDAwMDEPMA0GA1UEBwwGSGEgTm9pMSYwJAYDVQQJDB00LCBMYW5lIDE3OSBNaW5oIEtoYWkgU3RyZWV0LDEdMBsGA1UECgwURFVDIEZBQlVMT1VTIENPLixMVEQxHTAbBgNVBAMMFERVQyBGQUJVTE9VUyBDTy4sTFREMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlga8mO+fiI7It/tdu0RSojWGco14Hj7LpSEW/+baAo4XSseQNDTTkdpt1CrOWDLsQ4Dy6QjzCQbI2FIWDZJ7CQnw8FogPZZ7kiMttVrd1BSpEfpn2c5ZMm7OyH3EyfSMQpwIylFilirqMqHThHB5QpW5wK4hoAQrwRVzXfdJnduUWlc0Al6qORhLKIJVFlaiKMmLIQBwftmN+5vl0V8GORkEDZlX2EirHAg0fNA1cxVjVikRZx/60Og14wGgWTgkKAt25WMhW78MocQ6Akrxet5bcLuJkBAdhpSq39ICgEAKzGXcW5gmy/kZMRaYHx25ZBUdvRxJctPGEGKUiEiEhwIDAQABo4IBhjCCAYIwHwYDVR0jBBgwFoAUDuE6qFM6MdWKvsG7rWcaA4WtNA4wHQYDVR0OBBYEFBKCHr9zqb5fB5LTGZFCtN5UIn+vMA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMBEGCWCGSAGG+EIBAQQEAwIEEDBABgNVHSAEOTA3MDUGDCsGAQQBsjEBAgEDAjAlMCMGCCsGAQUFBwIBFhdodHRwczovL3NlY3RpZ28uY29tL0NQUzBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLnNlY3RpZ28uY29tL1NlY3RpZ29SU0FDb2RlU2lnbmluZ0NBLmNybDBzBggrBgEFBQcBAQRnMGUwPgYIKwYBBQUHMAKGMmh0dHA6Ly9jcnQuc2VjdGlnby5jb20vU2VjdGlnb1JTQUNvZGVTaWduaW5nQ0EuY3J0MCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAQD6M+fJIdL2o3WsFJs71aTfTpqiJm81Bu01GwY/v/TtLLe8cUK0pN55wc35gL/oHzZPIKuPJcH8QS1/72t3SMvivd9b8ez14/vkpz0c9CAa9P+H0uVWYHSHkjk67tZFm3CxknteZOQS50C2aWbL5pNwVyrDza8y6mEv+ri6tjlLKL9yJ8PMGNfYueAIefPeslh5jlTR8VI4s3AmFWmNOKGskQAEyCnL3J7I56c5Ic4C3ZC2UIyfrBtYA2hTOL+yPXTBYXoqIx9c58dPpR7nVxVIxYRokNO+WQQHSw0HCwcqAiuOLzt78wlpF49+aUHl/n3Fgo1JZzS1wYRe/DuAopQ=="
      },
      {
        "signer_name": "上海贝锐信息科技股份有限公司",
        "certificate_thumbprint": "CD22D7228E666132008B90BB8D2D143BFD36D4EF",
        "certificate_der_base64": "MIIH8DCCBdigAwIBAgIQBKWhM+f+21PI8WaHz7xO2zANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTIzMDQwNDAwMDAwMFoXDTI2MDQwNDIzNTk1OVowgfgxEzARBgsrBgEEAYI3PAIBAxMCQ04xGjAYBgsrBgEEAYI3PAIBAgwJ5LiK5rW35biCMR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjEbMBkGA1UEBRMSOTEzMTAxMTA3ODc4NjI0MTJCMQswCQYDVQQGEwJDTjESMBAGA1UECAwJ5LiK5rW35biCMTMwMQYDVQQKDCrkuIrmtbfotJ3plJDkv6Hmga/np5HmioDogqHku73mnInpmZDlhazlj7gxMzAxBgNVBAMMKuS4iua1t+i0nemUkOS/oeaBr+enkeaKgOiCoeS7veaciemZkOWFrOWPuDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAOJopQDuM9BxJ5WQmgHCz7fs1zZChUYjOW19C+SUsKAgy3cRP/Bfm2KeJtbXig4TDnFVdv09k2+MjqDAO1lferKQcm8wc2vKG6Ft2r+AS0eUhz+IdmxvVsPUUCpFbsAkHt5uHtb8LBJyXqFrYeyhVccRbcxZHTAeyHCzHcUOkSUxckEBj6CT94xzWxN/idh96ldDWWf8vrJmlSRtLXJFhSWUtMyuXbz6xydd1R8xE185F1AWNRgGXb8IEkrYcaqdj84nzzDnCJoPvcc0pPBxPG+YWucmid0JFO6E+Vvdmd6Sk/IHk3eyYTUJwQ5CuJJ/B2DgtZQdIFZdjDGuIBOPXqXGj2orusB2wBW4iJiJqRYSL4MVwsO8EGPofzecAXBuXx73cj0M+LI4NOpFOlBTKKBVSd7PsD4epEqUev2HbGQSsIZm3I6NFk78duAqK1hAfBwdyq9QuvczQkECOcQYnfAXoWRRmfUDl5dRyn/ahjJT+oUTbykufgGSWgOWEvf8hRFyakKo2w/Xn19GEjYHTN5spJu7xsisLdSVUN2jUU0bk1UX0AnvAiUcX7h4g/L4pATsOsLl9ON6GGP0nDsDI4GGKnlCabDDzla2/lMv+tScLZ+niEg8dK+/g0diLol0NVtyq6oaouCVWYlRoLKcBBbYhBtVvb5gFM1sqUsi/aTbAgMBAAGjggICMIIB/jAfBgNVHSMEGDAWgBRoN+Drtjv4XxGG+/5hewiIZfROQjAdBgNVHQ4EFgQUt9sRSy3XECe+vKv4UsxMowQ74twwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMIG1BgNVHR8Ega0wgaowU6BRoE+GTWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMFOgUaBPhk1odHRwOi8vY3JsNC5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDA9BgNVHSAENjA0MDIGBWeBDAEDMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzCBlAYIKwYBBQUHAQEEgYcwgYQwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBcBggrBgEFBQcwAoZQaHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcnQwCQYDVR0TBAIwADANBgkqhkiG9w0BAQsFAAOCAgEAwAPmorGMuQZuc8m3oJbb01jgyxLubzW7DKTFBouZO+NzB/i8UceGCK6/F03YgMHsp2Q8+a7P9fhxfOUlAzE11cSL69JPX7z9Vk5rZmbbWiH0TqpcxdFt9MI8RvRXAkM9wcAUIjmH8KxLAFeCDEzknH2JlyH+IBQZutAtEBm+o52qiUPyvhcR/rMNYuXSR7qbuReSApg3PpwCzgQEYojzrxMHcN8jl85lgOJvC1VLARjWijwVomArA3ep2aiMWyZEuGq6qBFxeUkyTxbJ+LIA4UTYuNv3b65s1M9tKFJk9yjhGaJNEkhfoxl1gwix1Z7/s47rktEy2SbPFila7n1ONs6mPiKC/QR6lfEgLk332ikLJw16zlx9bfst5wwd+tpxSNwvJP0uOGkK8+7/0pgjjip7M2bO2+jn9xmJ5xZA65QOloM/ldvbO4D0jjIXchSEj56UaDYxTGQOXcRo/8j+ZTkT5BKrwYni48fEyLWuKNYH/u3QgtfQHWmrCwMm8qgLPNUO4K7OtGDKWgOPIaUIIx9paJmu8vm+gTi8x0dsnYAPFgnTeiqeYf7+FMYlUAMdrcxfcHw/avsC62/v59nwopRMNASljjHjuhiCKnsapK/U2ClZxIhCEzyw1zD6PnukZDgkm1Vy8uOfa2FkHqEuAMA4ICbeFt8OKwLWTYeA1Uo=",
        "src_file_sha256": "995cdb276cd21557532b0b73c0ada53415f223400103177be9dd47e42a54e940",
        "src_file_path": "downloaded_files/aweray/995cdb276cd21557532b0b73c0ada53415f223400103177be9dd47e42a54e940",
        "src_file_company": "上海貝銳信息科技股份有限公司"
      }
    ]
  }
}