Extracted

• • Target
    d2438293a70edc12d8046502acc240444555ffc33ba674a42b0dddc886f23ab4
  • Size 45KB
  • SHA256 d2438293a70edc12d8046502acc240444555ffc33ba674a42b0dddc886f23ab4
  • MD5 a9e87e6a2db5558ddfcf1d40c5cba61a
  • SHA1 d5bbd08a83f6b9b0d3f9f0acaee8bb3df9acd058
  • SHA512 849a1034e4f70f394935dac90b17434f37fc2d1d349b8164b9ebd014d3b7dd040f0427fb2530464c6155d354cc4c4aa19129f2abf64e860f11e6f17c8a4f2c10
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1umaPylF3APIFzjb8gX3iD+KqWNKbJIJg0sRBDZcx:RuxkJTgip2Pfyv3lF3bTXSN6J/Jdcx
  • TLSH
    T186231A0037E8813BF2BE4F789DF26145867AF6636603D64A1CC452DB4623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2