Extracted

• • Target
    adfa3488f6b11004fdf6394991adf3a0789c4aec6e7aab33ad0bffaaee5fd81d
  • Size 45KB
  • SHA256 adfa3488f6b11004fdf6394991adf3a0789c4aec6e7aab33ad0bffaaee5fd81d
  • MD5 df706ab0426de3a8f1b8756ed1f16662
  • SHA1 0d00f0d2444a5d9f444c83be495c5c8f4907ee89
  • SHA512 bad6fac129b95291dfec133da24f445ad60e287577535e053d3841bd4aa85de9f48fed31c21a41c6d11ff506ab982fd8358ede708f224fc552f804ecd546522e
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrzjHynaKPIspjb2gX3iYlxywZE7BDZ0x:5uSy6pTpoo2onZsJbpXSYletd0x
  • TLSH
    T17E234B0037E9C22BF2BE5F789CF26145467AE6632603D6891CC411D75723FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2