Extracted

• • Target
    b949cc1e4fab0e664ff0a3a0415a3ec8e1ddebb851d48f8f9a12d1c5415c3c14
  • Size 45KB
  • SHA256 b949cc1e4fab0e664ff0a3a0415a3ec8e1ddebb851d48f8f9a12d1c5415c3c14
  • MD5 6c47c27150f6ec9656cdf92efad1d2f5
  • SHA1 494772f95f0261bece97083f84d594ce8ece8625
  • SHA512 3fb5acb35293244b0f04201d9feec1d51a8931c7d99b57bf2b028e6be341381e31099e43b7fd6f0360c377cb7d76051ce63db1400f3f7f37016047f4ad242570
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4A9YSnq3UPIqzjbwgX3iqYs3Mh/klZMPVaBDZ0x:8uUIpT4vAj2sKKkq3b3XSqrMh/kDcEd2
  • TLSH
    T1D4232A003BE8C12BF2BE5F789DF25145867AF6632A03D64E1C8411DB5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2