Extracted

• • Target
    a8944f94daff360a871e1dc03c78d1ddb9511015c4e4a8876b0335bcf7405911
  • Size 45KB
  • SHA256 a8944f94daff360a871e1dc03c78d1ddb9511015c4e4a8876b0335bcf7405911
  • MD5 3f4cf989b9b9ed610ac63fa0c4eb612b
  • SHA1 01f3adc33f7b80fd4d4089ce2f119b28cdba9dd6
  • SHA512 a7a9f6f8bbaf6c503d9aae9b383d89ee7c375d0405f20798a8e7abea54ca5ccd397f14aca8aef391a9338ccfd29fe06ff68e3048135e0534fd930063c310682b
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9sZo3TMtPIQ6jbtgX3iGlAo/KBDZ8x:0u1YJTHcw2dU3QWb6XS6/Ud8x
  • TLSH
    T1FF231A0037E8822BF1BE5F78A8F26145867AB6673603D54E2CC441DB5623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2