Extracted

• • Target
    04694b29a62e9f4022a9e09185c48b3600c5bbd837c9c7b29949eb488d80c39c
  • Size 45KB
  • SHA256 04694b29a62e9f4022a9e09185c48b3600c5bbd837c9c7b29949eb488d80c39c
  • MD5 876affcd83aab3a1520876489b7f9ab4
  • SHA1 567488374985359bfccd9391fa3f4884876564c9
  • SHA512 01d8fb42adfce59f547140a3bd887642545bfdca21c9f644d746936fb1dcc79e2db93549943dde46ed20634d1817a1746337227252b77ca87b7245bd8195d61e
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvZjbmgX3iUHFj2ATBEP4aBDZEx:MuLAZTnbg2Z4EaHvZb5XSuFj2UwdEx
  • TLSH
    T139232B003BD8812BF2BE4F7899F26145867EF6776603D58E1CC401D75A13BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2