Extracted

• • Target
    1e630e8f625a46aa04e27da39d814cc3a907c77caba3b72862507f08354d8e6f
  • Size 45KB
  • SHA256 1e630e8f625a46aa04e27da39d814cc3a907c77caba3b72862507f08354d8e6f
  • MD5 9759e2f1373d36b9733a40b3eedc57b4
  • SHA1 dea1c19ad6af3698b673c7cf9c98b02d38623118
  • SHA512 24ea0bcec46bbc93720ea9f21ad4d5746081f4ca0bc61a872dfd99de383335bd42c418f37b3a48fcfe39f97d7bc78804ae565bf47bf3e85f1e82aee5f4bbcc6a
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw8fBohEa+PIvFjb6gX3i1S4lklhAtq0BDZMx:ku40ZTXEb2C4EaHvNbtXS1S4i/nCdMx
  • TLSH
    T109233B003BE8822BF2BE4F789DF26105867EF1636603D54A1CC451DB5713BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2