Extracted

• • Target
    abd28f18c4120ae0c635704d24dfe7720f868fac96da68e7052154ab6e05bdc2
  • Size 45KB
  • SHA256 abd28f18c4120ae0c635704d24dfe7720f868fac96da68e7052154ab6e05bdc2
  • MD5 5c3efa12e7f20b1192cc3f079832dfa8
  • SHA1 e4f1f4809c9f9c5cf9c6b70b9a68762ca03e00c8
  • SHA512 013e6ba3fc9b5b338032153d200811d48e8ec87052ca291483023285b4b1a9e23bd910e60bed9ffba2c82cc69d7cd6c2dffc0518e0e42bf3e40dc00714967514
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHBlte40WMOPI0IzjbWgXNi69OD5r4FjyBDZEx:MuLAZTnbg202UM30I3bJX869OFcMdEx
  • TLSH
    T116234B003BE8812BF2BF4FB8A9F26145467AF2637603D54A1CC451DB5713FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2