Extracted

• • Target
    a4b5b3a46ace3e0df72873f1db85e4fa8a0081ead2f5b128bfead22fbca7f76a
  • Size 45KB
  • SHA256 a4b5b3a46ace3e0df72873f1db85e4fa8a0081ead2f5b128bfead22fbca7f76a
  • MD5 38aad9acea55efa710045c179b118027
  • SHA1 e3dfcf993fba47c04a99c0c7e6640ae9cba5f479
  • SHA512 6bff6aafa6598292a2016e0f91173eae834f553344e531c4da633e2478845d4a1e09a77f86e721318b11b3190e1a909eda5239b7711942c5cc15d907d142d329
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwY3HO4SNMOPI0+zjbagR3iT+UgmlA+gg7dBDZMx:ku40ZTXEb20+JM30+3bNRST+U7aIzdMx
  • TLSH
    T13C231A003BE8812BF2BE4F78ACF26145867AE6636603D65A1CC451DB5713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2