Extracted

• • Target
    448d753b26ca2ba57ddba82fe69f64ee999ad89f15ce35ed5b3a1bea61843bbe
  • Size 45KB
  • SHA256 448d753b26ca2ba57ddba82fe69f64ee999ad89f15ce35ed5b3a1bea61843bbe
  • MD5 8d4ecb542748a08716c57fd0b4f53e55
  • SHA1 5f9f6b02dcc86b6fd8eb76391a83dd9e5a8a8f73
  • SHA512 2936151d5d024e416ab7a86a7ffa928d695a54acd53a1a5d8b2362b8a16e8185955c66b37eb995f6efc6130c27366ff299cc9545e0cf0b9632160cafbfd3418a
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVh0e3NEAKViZPIazjb7gS3icYEAkUI20fNP0f9fBDw:MuBGJTPho2E3exiWa3bESSgAkUQFP+9O
  • TLSH
    T1602309003BE9812BF2BE4F7869F26245867AF6733503D5491CC451DB5623FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2