Extracted

• • Target
    4fcc870d523067133b1be21621e8c35c6f7cea8c0389c5402e82e618310bf9eb
  • Size 45KB
  • SHA256 4fcc870d523067133b1be21621e8c35c6f7cea8c0389c5402e82e618310bf9eb
  • MD5 b8d1199ff4e39e03f2ecf9cecbb32406
  • SHA1 feb0a3b2e51a70364588e7bfe331f2dbf3787121
  • SHA512 53772faf40cc7ca4a36230ceb4977cfd3ef7d90d887db848ed7e9beee9afb715f777881fc1d96ee22af715c7d38f162dda36b24241284043fc3d317dc59d2dc4
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9Ewz/y3qiPICzjb7gX3iiZ9xI+5Tb/3A0YHQBDZsx:EufspTf2g2v0hC3bEXS291j3ADHGdsx
  • TLSH
    T104232A0037E9C12BF2BE4F78ADF26145467AB6633A03D6491CC4119B5723FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2