Extracted

• • Target
    238b1882f9013c28648416248a20712eb7c5df92c615532741bb304b302b7b02
  • Size 45KB
  • SHA256 238b1882f9013c28648416248a20712eb7c5df92c615532741bb304b302b7b02
  • MD5 6a5c4be7b01a44c3314ffd1b677419a9
  • SHA1 2efe6819cacdcc187fe300617958a5c1eabaf3c0
  • SHA512 01bfcce91ac6a3b4f925b978427dfc06734c908ec713bc09ef2cddc8936cd993ab69ec6f6313011fed3c6dfa8a3e6f1f28282bfed13b4ee7bd8ee24d1edbd723
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qA/BjusyQowsPIWzjbPgX3pKnlQD/dwmh9AfQBDZUx:cuqNJTLr62PBjuxZwRW3b4X5KnlQD/da
  • TLSH
    T188232A1037E8C12BF2BE4F789CF26146867AF6633603D9491CC451DB5613BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2