Extracted

• • Target
    5c8dbf49d76bcc04061ec83bc6d849ed7b5ac609e5f450bf36bd5ec4a7b339c4
  • Size 45KB
  • SHA256 5c8dbf49d76bcc04061ec83bc6d849ed7b5ac609e5f450bf36bd5ec4a7b339c4
  • MD5 a31c5d842e8db8603d88677bcaf7fa55
  • SHA1 fdf631f3a790ec6ae39e01896bce9879a361feb4
  • SHA512 6240fdfbf7dbb893b41c788f3d119dec0a9c2e1d6b457671f2ee23d34bdd756b36c2895173e0189b4412baf2b34779ea826bbc8f94e89ce83b7ae8fbfa84afef
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVu8kLyuObvtkjZPICzjbkgXLiyDjN5Kux7ansyBDZG:MuBGJTPho2H8LuyyjWC3brXGyDjNVx7p
  • TLSH
    T1A9233A0037E9812BF2BE4F7899F26145867AF6632603D64A1CC441DB5723FC68A43AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2