Extracted

• • Target
    ab69480cd764052efa3b243369db97c43b8b44e4b1dec0e5d1f282ac6408bc2f
  • Size 45KB
  • SHA256 ab69480cd764052efa3b243369db97c43b8b44e4b1dec0e5d1f282ac6408bc2f
  • MD5 6409d6353f94472bd113df4913465494
  • SHA1 b3eb657ad77d76096fb32d5d935a94192bfb88c9
  • SHA512 5c2326b3bf7d104952bb0e0d6e871f2af4fcbd937e85d391755fa10c2b59e21c16fbf2588e52a1020a5bbf33fb6595eda9511b3def284338ebbbb83a2a0c05e6
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAG9PLzizyvtLjZPIXzjbHgXeitgcL5O2zGxODL3Pw:cuqNJTLr62W9HiGVjWX3bAXntgclO2zY
  • TLSH
    T1E72329003BE9812BF2BE4F7869F26145867AF6632603D54A1CC441DB5723FC6DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2