Extracted

• • Target
    d233ea904fd0a6ede835fffe2344f5ac3ff5f7cd23b8a7cee6497fc1621de9c3
  • Size 45KB
  • SHA256 d233ea904fd0a6ede835fffe2344f5ac3ff5f7cd23b8a7cee6497fc1621de9c3
  • MD5 f65507f5bbe459e7b278d815bef83551
  • SHA1 eb4fd3bac5392a7d58c0049ebdd2a6e8c4ba6fef
  • SHA512 b617b49bcab3e927242846f3439a20fd344e30cfce031955f7615f2bf9c8c30b5df978e2f49c4b4312009fbb7114b9d79cd3b8b77103feb06a14919c5b86ecca
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjMzjHy/aKPIbsjbZgX3ikN/DOo3Iw6/BDZ8x:0u2vpTDe+2Fnhbcb2XSkNqCIwcd8x
  • TLSH
    T128233B003BE9C12BF2BF4B789DF26105867AF5633A03D6491CC4119B5713FC69A52AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2