Extracted

• • Target
    3491505552ca932e0893ed26008072e6c9444c07a6ffb13e81d7f93109721add
  • Size 45KB
  • SHA256 3491505552ca932e0893ed26008072e6c9444c07a6ffb13e81d7f93109721add
  • MD5 d7e74465d54e654958fb374f472b591b
  • SHA1 c899f1b4e41b33e9008b221b8e71f1624da9bf3b
  • SHA512 0e8448e24ccfa725e2f32ae1520533e45654f3dec143587409d9446f922af2122db1fd63dbe53f7bea3a7a10586dffdb9769e9657f572aaca6c3542dd91ebc48
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPylF3APIFzjbMgX3iavuPFODUspVaEKtGC7BDZm:suJdpTPdI2Hfyv3lF3bDXSavMVFtNdkx
  • TLSH
    T182232A003BE8813BF2BE4F78A9F25145867AF2636603D64E1CC451DB5623FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2