Extracted

• • Target
    3029127cc901a9c2845dddc9ebe17f9e216c1c1187a05d74ab88b869f492a1ed
  • Size 45KB
  • SHA256 3029127cc901a9c2845dddc9ebe17f9e216c1c1187a05d74ab88b869f492a1ed
  • MD5 5038bc94168912644bbb6b3d20562316
  • SHA1 896fdc8b3d05ff4899d7afba280e553db90f34e8
  • SHA512 a3a01e194894cc25509b8ebf79c5f4322d06e0166fa9cc9d8ff7beec8fe5b43380b8b7ee3c95fcbb6516382785b85605f7e7c6a18903a43bf6a2e6b318c18792
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlneeXK5oibbb6TN8/nPI6WzjbBgX3i0epimM/GB8:wuDWZTpMZSB2DeEqTNKA6W3buXStpiDD
  • TLSH
    T1BD231A003BE8C12BF1BF4F7899F26245867AF6632603D94A1CC4519B5713FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2