Extracted

• • Target
    sanami.exe
  • Size 47KB
  • SHA256 eef6b84f963cbc03178aaa926c6daa1c10eef19db60a98e3395e15f42f87ecdf
  • MD5 5e6f4841183dbeb70751dcaba195ba35
  • SHA1 fee0683eca1499174b777a8f83b4b17162c37999
  • SHA512 44b619f2aed9384d5077320028ba2cbf8621c81c3c51c9e64458f60754e036ecc11a4bab3c29e7b3beb08dc17401b009a55af430244722ca8152c1e08cf1d755
  • SSDEEP 768:MuQqNTvEEaBrWUXFd5mo2qmiUh/knpHzxPIUUN//0bcAgSIGt2+ZjOMUbOMVX1WL:MuQqNT8572xFhMnpHSUUNkbPgqt2+NOI
  • TLSH
    T1D4232B0037E98126F2BF4F74ADF33145867AB2676602D65E1CC441971B23FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  98win.ceocommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2