Extracted

• • Target
    038a7609608c297aa50c73c407468ee8af92f1a3ced488a051c9736241ddfc86
  • Size 45KB
  • SHA256 038a7609608c297aa50c73c407468ee8af92f1a3ced488a051c9736241ddfc86
  • MD5 efa90c86c1b815267afba06782abb6e3
  • SHA1 1f147d291aaea847f95d6bf2a5aa7a576f9bb879
  • SHA512 32c0a368b18bbcbdaa64202a4be9d5413bc9aa86e8d27aa7a4976d37b9f9f0f95c7daa8394abb4bd4bf4980f9ad3e771cee1252bbc8ce93438c622876c5e9dc7
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9D9Y6kq/zNOPIyzjbrgs3i5wrHEgMPHKehEBDZsx:EufspTf2g2Oa9C3y3bUsS5SEtHadsx
  • TLSH
    T154232B003BE9C13BF2BE8F7859F26145867EE1633603D64A1CC4519B5723BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2