Extracted

• • Target
    0cb8e022f6d11e526d68938a7ee4873f96db701fbf502c79e6b55361636961a0
  • Size 45KB
  • SHA256 0cb8e022f6d11e526d68938a7ee4873f96db701fbf502c79e6b55361636961a0
  • MD5 01e62e1b6d54f9bf1d71ced65a7f8615
  • SHA1 3642bbdb119cce8c38bcb780131af61faf79cc89
  • SHA512 49f5c6d481d99a58b1d7a4e8d7f2952920d9366efb01422b3b14de2f5905615298416be5a3d680640296c4d40421943544511e495d0ae22a4a2d3be6a1b8e8b3
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8lsNoPEaMPIcajbPgX3ii0BfO5DaVaUQJlzBDZMx:ku40ZTXEb24suEaxc2b4XS5aUQJlVdMx
  • TLSH
    T141231A003BE8826BF2BE4F789CF26145867AF5633603D5491CC451DB5A23FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2