Extracted

• • Target
    b2af55848de58299c26696f3f65e14a1b571e54aa1b7adf77415bd5c4b3e0387
  • Size 45KB
  • SHA256 b2af55848de58299c26696f3f65e14a1b571e54aa1b7adf77415bd5c4b3e0387
  • MD5 dc1051b81172a2a9b59885f3cbe52eb9
  • SHA1 4f2f066a6835b4a47653a0c4754e7901d7a61185
  • SHA512 cd0fc603a3a64719907818b8a3f397fc544e6eefc57b4b8ab5abaf431e04619ab3f646015e548c1faa8cf01f8c0cdf4ff9b97f356ee1817e4ff0f6d13db4d1bc
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1/BzCQKx7PIm6jbfgX3in6z/oSb9h/vWXBDZUx:cu6YepTPso2+o0mWboXSOoYh/vWRdUx
  • TLSH
    T12D232B003BE8823BF2BE5B789CF26145867AF6633603D5491CC451DB5A23FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2