Extracted

• • Target
    d34a0158be15bbf8a30c627e978fa00aad89d7dd518957a8f460e091aa27e983
  • Size 45KB
  • SHA256 d34a0158be15bbf8a30c627e978fa00aad89d7dd518957a8f460e091aa27e983
  • MD5 7a0f493c1f7389ebafff34a53f69a114
  • SHA1 66ddafcf5dcda19d2f9c42b5dbfd07d1bbdffeca
  • SHA512 b08916fb20d6df4a6112dbd2fc29032d5390e018d9e62a227fdcd2dbd102c3dc4e2762a96a0428de836e36953f7b4a73fc760c43aa85a1db449ed19863b507de
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYrZo3TMtPIQQjb3gX3iCJadpOs1PtBDZ0x:8uuSpTgyf2tU3QYbQXSCJa7Ostjd0x
  • TLSH
    T199232B0037E8812BF2BE4F789DF26245867AF6673603D54E2CC451DB5623BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2