Extracted

• • Target
    d432993962b7b3820e059d38ce734e40eb34698e3625406bdccbd2829a09e20b
  • Size 45KB
  • SHA256 d432993962b7b3820e059d38ce734e40eb34698e3625406bdccbd2829a09e20b
  • MD5 a292ca69f3e190750935716982233d8a
  • SHA1 d4f912a64115416944893fad467eca8b7ea02668
  • SHA512 5ad4fd2aab3844455f7f9550864035806e7fecbf216e0290367ba0f29d1692313b015199f7013d1c90b01c828d40a315250bb92a86211643a5b5f0079dccec0f
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9aCSwTMSPI50jbFgX3iuiv4+NUIHjBZBDZ8x:0u1YJTHcw2NgG5UbCXSuih2iBHd8x
  • TLSH
    T1E0232B0037D8822BF2BE5F78A9F26145867AF5633A03D9491CC441DA5723FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2