Extracted

• • Target
    dffae0381d8398f668ab09673c7fe24ed07381eb010ef9a1c3b41867010f455a
  • Size 45KB
  • SHA256 dffae0381d8398f668ab09673c7fe24ed07381eb010ef9a1c3b41867010f455a
  • MD5 2882d95e6d29541bdf83f6c85b8987cf
  • SHA1 85b0a97b0703adbc0314afffb7bac5fca9efbb0a
  • SHA512 38a594b18c3de97e9763d49efac5693a516146c0ca4db0a1aa49d82b7d66bbf6e0c714be460cf3c154b8ac55d960b5ffa51c291aad3f1a342a22628ea93cbf1d
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA7xJdxCPHuPIXzjbUgz3ivrLns4sBkmlBDZcx:UuKWgSJTwRf2rZc3X3b7zSvrLnsvdcx
  • TLSH
    T1C0232A003BE9812BF2BE4FB899F26105467AF5636603D6492CC451DB5623FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2