Extracted

• • Target
    f38afad8fc32bc6f19c01ffaebcf1a6de4ac24efe569dc795f45435ec9e5df52
  • Size 45KB
  • SHA256 f38afad8fc32bc6f19c01ffaebcf1a6de4ac24efe569dc795f45435ec9e5df52
  • MD5 1b721710a1056652ffc48029ea790e31
  • SHA1 d831e18b1c0cfed8972b5b1bb1499d156edf6dd5
  • SHA512 013c7df7d124335bfbb2138422101a9716b4ebff7ba86d8701b7344f41f58c7b4e0728548f481ae8130f86e2f593541d22b36bdd3f080fac0d1d9ee1e4a2c84e
  • SSDEEP 768:AuAVhJTDEQAQWUaDyzWmo2q7xGFZQjB4PIFfzjbRgX3iZ+YSptpX6BDZQx:AushJTDXgH2TqF9Ff3beXSZ+YMXkdQx
  • TLSH
    T179231A003BE8812BF2BE4F7899F26245867AF6733603D6491CC452D75623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2