Extracted

• • Target
    c407ec74a8ca346d23cfab3c171ddc5f40d5240e36ec86d60d189e088d1cde1d
  • Size 45KB
  • SHA256 c407ec74a8ca346d23cfab3c171ddc5f40d5240e36ec86d60d189e088d1cde1d
  • MD5 08ff4a1b6d67e49d78b99db09d157040
  • SHA1 7d34bcf3a70a24b419508674c58e924d09ad055c
  • SHA512 3e66653986e8d5e8f895e5beadf4b517c7a2d2849e92810a5bf8c924628477fb76aceb3a83fd4ee9d99c1c0b5263f5c38b6ececa05e19719f4e59f56f60b6c35
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVE10CnMQRPn98PIQzjbogX3i//5ax2YtoiBDZEx:MuBGJTPho2dtnbvBQ3b/XSneFdEx
  • TLSH
    T1C8231A0037E9812BF2BE4B7868F26245867AF6737603D58E1CC451DB5A23FC58A436E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2