Extracted

• • Target
    2a411604047de491d4ad7ce41d2b6fb5013c04b298cf935066e8f49060062b61
  • Size 45KB
  • SHA256 2a411604047de491d4ad7ce41d2b6fb5013c04b298cf935066e8f49060062b61
  • MD5 2355e0914bcfe9cd9c2266592026e193
  • SHA1 1dbfb77cc55282c69cf9b83d8ea7aa6ffd2eadcb
  • SHA512 becd3a9b2b7d765a3b46408e60914a474cc3101af999f56b7de60d45825b53a175912894adeb6d60a55585b2a9e2e293dac98f079c583c6efa3bafa30ea32366
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qACLiE0yFjrdjYkk8PIuWjb9gX3iaIv5h61nQ8nZfi:cuqNJTLr62yLBXQBuabqXSaIH6NTZfip
  • TLSH
    T113232B003BE9812BF2BE4F7869F26245867AF5636603D5491C8441DB5B23FC6CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2