Extracted

• • Target
    a3f5d42968787c963efd4e06b1c9d5d459f8ab237ecc07700840e3544079a879
  • Size 45KB
  • SHA256 a3f5d42968787c963efd4e06b1c9d5d459f8ab237ecc07700840e3544079a879
  • MD5 6bde2b47d2770619034bd345924fdf13
  • SHA1 1f26cd06a63a1d29acfffd2d491b93c1c4ed5c49
  • SHA512 9fa7e8f08b173a6155875ee53d86ea1def0a60c732bb157a6701a8e90aaad030ecb8b16299535909ee3ccd9c74ee487b352e6cb9fb903194f2a3871e4b6ed10d
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q11Bz3QKx7PIQOjbpgX3iEOT0kve2ZF0WBDZcx:RuxkJTgip2AV0QibmXS3TzbZdcx
  • TLSH
    T19F232B003BE98637F2BE4F7898F26145867AF6632603D54D2CC452DB5723FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2