Extracted

• • Target
    4be9f76ed63883e9ba13b0fe7ce4f4abe2b7bfbf9cab29033177e74232f363e9
  • Size 45KB
  • SHA256 4be9f76ed63883e9ba13b0fe7ce4f4abe2b7bfbf9cab29033177e74232f363e9
  • MD5 3bd3e2074da05b5cffd563510da3f153
  • SHA1 0e460cf7680058e79cfa8c11b185aae62fcedd12
  • SHA512 7ed0a75600284708963e08fb95348aab3f07545b97db404c3695faf5b2db7d959755c1af5d0ca6342158f513d68e3757062b1c773da84501f37f22f600770a09
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFK/T3u40cMOPI0YzjbagXti3t8yttPCBDZUx:cu7e5TH2A2ji+M30Y3bNXc98Ad8dUx
  • TLSH
    T1B52319003BE9812BF2BE4FB89DF26145867AF2773603D54A1CC451DB4613BC6DA426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2