Extracted

• • Target
    fad140a4ab51dad88f8036cbf884e0018afe1012953bacf5f38ff8764ad769b7
  • Size 45KB
  • SHA256 fad140a4ab51dad88f8036cbf884e0018afe1012953bacf5f38ff8764ad769b7
  • MD5 a1a46b65cb6378053056b466d8fa391f
  • SHA1 cb188905726b119bf18fef1c3c5ed618f5554fc1
  • SHA512 69424e6c465fd71b9d3804928f5cf3a03954a7d74c5599f616d5ff2d9b24fcb1eb68c5fe186d4b4b541b03eca0bb55060a1d91b11b1c0d7d6ba84f490fcee331
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qj79Yq3qvhOPIOzjb6gX3iohwiJ9Qhly5uxBDZ8x:0u2vpTDe+2QaCC3O3btXSmPJ+ly5od8x
  • TLSH
    T1C9232A003BE8C12BF2BF5F78ADF26105867AF6632603D6491CC452D75613BC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2