Extracted

• • Target
    0662d2605b4098043ce8c692f8023a76cacf49438962ed459d66062c3c8b451a
  • Size 45KB
  • SHA256 0662d2605b4098043ce8c692f8023a76cacf49438962ed459d66062c3c8b451a
  • MD5 a05791239f8495e3e773c9fe1b636e28
  • SHA1 1c77a2e01456f8ede87956754741e731afd8192f
  • SHA512 48cf56d43e5d705f4684e86923b3ca024e8c7c93417ddf72fa89f0d4ce11c195aceee4df55f4479f52f2fca8d52c54a3b0ec893312ba77e70416e8e13eaac827
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE0yFjrdj3kk8PIhGjb/gX3i26nKkfOUBDZMx:wuZ8pT1tc2KLBXDBhqbIXS26Kk3dMx
  • TLSH
    T14D232A003BE9812BF2BE4B786DF26145867BF6632503D54A1CC451DB5623FC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2