Extracted

• • Target
    e4166cd893fa745731108f92a58b1cc7d91d83c0dc768f5666410d332f104a59
  • Size 45KB
  • SHA256 e4166cd893fa745731108f92a58b1cc7d91d83c0dc768f5666410d332f104a59
  • MD5 384b6c688d8d1f08465144cc43fbcf5c
  • SHA1 50a1ddbb3c2f6ba04941dc2e7c53c3c6c100a5af
  • SHA512 3e312980dc39df1845839b9bbfdd98cff7d2b5ec20224315945d590005fd1cf41d40c192444fddec66423e04906759b0fddd976d424a55e2b908a30ff17d104d
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF7fBohEa+PIvVjb+gX3i+EP8vFHlosdc1gSBDZUx:cu7e5TH2A2q4EaHv9bBXS+PRcJdUx
  • TLSH
    T1C4231A003BE8C22BF2BE4F7899F26145467AF6A37603D5491CC412DB5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2