Extracted

• • Target
    a8abf235cb42bc8e302a29bdf80b64db39dab41cac7c6178d4d0dcbd05cda92c
  • Size 45KB
  • SHA256 a8abf235cb42bc8e302a29bdf80b64db39dab41cac7c6178d4d0dcbd05cda92c
  • MD5 54335f8781e9808d77c301ea242d6af6
  • SHA1 b50866dafc80f9dfe89a1b806cff0ef3f328dd87
  • SHA512 e3d782b8f1fca5975ae2d8c6724e5f980d7f407c5ca5e1316aea89fd8c7e792fedbc3518d20d817e84eed8e173bf1fabbe8e66bd011d06da45162b1f96c7c31c
  • SSDEEP 768:5udApTNctooWUS7C+mo2qt+CHyTtTPIWzjbVgX3idz7NCJiUyme+fmLEKBDZ0x:5udApTNmU2JnKW3byXSh4qAUd0x
  • TLSH
    T10F231B003BE9812BF2BE4F78A9F26145857AF2673603D58E2CC441DB5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2