Extracted

• • Target
    1040b7494863afd9a48f62d9ec292481640aec510af0276c7328f9d3c12b37a3
  • Size 45KB
  • SHA256 1040b7494863afd9a48f62d9ec292481640aec510af0276c7328f9d3c12b37a3
  • MD5 2dcafee15bd51558648474989ba36c84
  • SHA1 c1659c5a177b617101d3dc79a6234b20daec422c
  • SHA512 74ad72ecca7cb221087475054c018d4543c4f09af1ad4dcce03bfa60b0d18025829f00b59caca01755cacaa37d1c34bd7ebaf6e44fcfd108356dc01db466038a
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1O8V1NpVmcPIXzjbzgX3iBUlATICghvBDZUx:cuR0JTPjY2l8VX7mhX3bsXSaATqdUx
  • TLSH
    T1E5232B003BE9813BF2BE4F78A9F26145867AF6633603D54A1CC442DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2