Extracted

• • Target
    be6cd28377fffc5d568fb708d685b5bcae2faf1e3be37cdb13b34ae2c575599a
  • Size 45KB
  • SHA256 be6cd28377fffc5d568fb708d685b5bcae2faf1e3be37cdb13b34ae2c575599a
  • MD5 4be93dd7e04c4405249da15186bbaa77
  • SHA1 5baef0b2b1018ae20ca6eb21e2b0e08b466164ac
  • SHA512 df57be3ee5a344e65edb4c710cf59d43863550ee582582d2479d084cefe31afa6714a9bd3f216e2e509d365dd56f8d96d79e9c85d18e2673a195077041dd28b3
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q479Ya/qfxOPIXzjbAgX3il0ZLBhSBDZ0x:8uUIpT4vAj2faKC3X3bnXSlGLBhsd0x
  • TLSH
    T1CB232B003BE8C12BF2BE5F7898F26145467AF6633603D68A1CC4529B5713BC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2