Extracted

• • Target
    46b432728b69ca4f749b21a8dcab694747a247958b94b23f01e6bfea44444683
  • Size 45KB
  • SHA256 46b432728b69ca4f749b21a8dcab694747a247958b94b23f01e6bfea44444683
  • MD5 25efe766df8b461c9f105350d65d51ed
  • SHA1 6ce6c8677aa614cddad2a401921f5d44ece951f0
  • SHA512 ee730d3f96a57d5b29ccb9a340b3d6b6cea9e3ff54d18ab2b0a89ad272a4457ab9a40499c98f0e045a167b44209c5f1468a5c9ab3c492dc9a1846963d17690e2
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtSCSwTMSPI57jb+gX3iLGpAfz5EHSvj9/JBDZ0x:5udApTNmU2lgG5vbBXSLGa1WSvpfd0x
  • TLSH
    T1FD230B0037E8812BF2BE5F78A9F26245867AF1672603D58E1CC441DB5623FC5DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2