Extracted

• • Target
    a272e9ab4ae2bc9bdf4a2cf1c53b5890bbf49d67dbb82ca9e9049c48b8a70c0c
  • Size 45KB
  • SHA256 a272e9ab4ae2bc9bdf4a2cf1c53b5890bbf49d67dbb82ca9e9049c48b8a70c0c
  • MD5 4ebc3b8f6ce4cc5b7f8a9ee78e647827
  • SHA1 f01306300ae91dd7c6eeb447cd2470c3d4100972
  • SHA512 2feaf6b03cdc6e47df77598ff2860080a2700b323d85020c6acd0eec17b746e01c448833e668fd8fa7350daba6aaf680c7c69048219ff1124cecbbf81582125b
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q9C9Aa0yPzFOPIRzjbugB3iytPnvw/VqXv+qEBDZTx:QuflpT8Hv2Pydi3R3bRBScPvwYXmqydN
  • TLSH
    T12A233A003BE9C12BF2BE4F7899F26145467AE2673603D64D1CC451DB5B23BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2