Extracted

• • Target
    046c8efaa6f8af1345ef79b8aa61ab5ee63c4dc06e54fe1e3b505eb1af9f0675
  • Size 45KB
  • SHA256 046c8efaa6f8af1345ef79b8aa61ab5ee63c4dc06e54fe1e3b505eb1af9f0675
  • MD5 fd3a59c5804403349069c401351bc980
  • SHA1 613656ac93f270bfce3d56e0dd971bc0166b32fe
  • SHA512 d240a20ea5b8ee8ac46c79e8c17761735e3910fce910c9cb3882d5002d14938dec600a8252374447a705b76cc195ae16860be85886e25a9133292b42b3e0af1f
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyL5P02FUFd8Ykk8PIwzjbfgX3iUiVvbPkjhSMlBtf:MuBGJTPho2/LDmTBw3boXS7pPShxlBDF
  • TLSH
    T130231B0037E8812BF2BE4B78A9F26145867AF6633603D64A1CC451DB5723FC69A436FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2