Extracted

• • Target
    d1477a4cad4cf80829a32e7b412a5eb513f35bae7ea04c9f745f52f7aaa1c4f2
  • Size 45KB
  • SHA256 d1477a4cad4cf80829a32e7b412a5eb513f35bae7ea04c9f745f52f7aaa1c4f2
  • MD5 47dda627fa58b382cb1250cd1f88f405
  • SHA1 d66555cb7d28a6506e5eda9b65792ee325d53fae
  • SHA512 7f3b64582440325b667a75325ada99e2d8add74d8c97ea30971494c7b516e4542a5935e8f7a7cd565220e19a2d982f529df45f67cbfe116509a3128c2926874d
  • SSDEEP 768:YuJdpTP3tcsWUODmqmo2qVX0UwPOlehAPITpzjbxgX3idU2kuacySiBDZYx:YuJdpTPdI2u0/OghlTp3b+XSdgjScdYx
  • TLSH
    T156233A003BE8812BF2BE4F78A9F26145467AF6637603D64A1CC451DB5723FC29A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2