Extracted

• • Target
    af9a333e7b9ee06d1331c44d5b9c832f379ddbd955d97506c46d1104255c19a9
  • Size 45KB
  • SHA256 af9a333e7b9ee06d1331c44d5b9c832f379ddbd955d97506c46d1104255c19a9
  • MD5 b4ff113d8c2262b7de375c1227e9d0f2
  • SHA1 2edcf1e4f6cbe6d18c6c1d7c80351037c86e1bac
  • SHA512 2371cd4ec85c9c1c717c3a55493a8e9373dded3256e29301bf645071321dfe6138433740ef1fdfa336d81582c47193175c7757fc4d8c2a596cb6b40aebad0a09
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1RpPEcPIMzjbzgX3iulHnenFyDqkKNUySBDZMx:kuSOpTPOP2W8VDZEhM3bsXSK64dMx
  • TLSH
    T174233B003BE9823BF2BE5F7898F25145867AF6632603D54E1CC4419B5623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2