Extracted

• • Target
    f35e3df8ce550697ed400ffa9a26ac2f9e7d50a37dbe7aea47d395163ac15ac1
  • Size 45KB
  • SHA256 f35e3df8ce550697ed400ffa9a26ac2f9e7d50a37dbe7aea47d395163ac15ac1
  • MD5 63cd6490494998b23f6a3e5c16ece48f
  • SHA1 671bc6e692ccd66db6526214334aee4587ef2b06
  • SHA512 4c59382053d4877c87c100406ad2416983cccaadc8ef6e97e8eed6a6b5ac86f680a24702d47db98f04cf9b050dc4fd4ba74c18fcf2a85c3c466196b3cd441f99
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAqqyx0OFUwdrxIkDPIEzjb2gX3iOI3MDUcpNBjaUBDo:kuSOpTPOP26qKTNME3bpXSOV3BeidMx
  • TLSH
    T183232A0037E9812BF2BE4F78ADF26245467AF6732603D54A1C8451DB5B23BC58A436FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2