Extracted

• • Target
    ca15bd744dd3341ac6011206895f951cb6a1779c15e4efb9e3ca5efc0aea367a
  • Size 45KB
  • SHA256 ca15bd744dd3341ac6011206895f951cb6a1779c15e4efb9e3ca5efc0aea367a
  • MD5 d338dd9e10eeb835bda58cdf549c2a7d
  • SHA1 eb5188c5bbd3e298b8b00bd3c7710327283a142c
  • SHA512 1150efed2bff5813f23bc2c57e23f8d4a49148332031b586ccadade8404d2989f82c75c02e323159f723c4d026088a9ce3f8fe1410ad6f8647e5cf15d03d7358
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHBlte40WMOPI0Izjb2gXZiG887H4OyvBDZEx:MuLAZTnbg202UM30I3bpXoG887iZdEx
  • TLSH
    T17D233B0037E8812BF2BE8F78A8F26145467AF6673603D64E1CC451D74723BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2