Extracted

• • Target
    b846760cadccb2875a4b5e2b0a801f2d77918baa980a351a7917a6718b8a1c73
  • Size 45KB
  • SHA256 b846760cadccb2875a4b5e2b0a801f2d77918baa980a351a7917a6718b8a1c73
  • MD5 fd7faaaff8a684dd838329c858b78d2b
  • SHA1 4683c263b62b9c7bd25e16c997e36fb5e5be19a9
  • SHA512 d7cdb921c3dfdad14cae949c51fc0f14c93ebba86dff73c8ea8c3c4b51b2047eae02134e7752066c3927e8e477720e194d15975a6fed1f72a0fe0e2b4ed15a04
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4ziD8yfzuOPIlzjbFgXSi7ZozkKGBDZ0x:8uUIpT4vAj2niAJ3l3bCXb7ZTKId0x
  • TLSH
    T15E232B0037E8812BF2BF5F7899F26145467AE2637603D58A1CC4519B5713FC6CA42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2