Extracted

• • Target
    3242b78318484571e6727e40d9a3e5cb36349e7a3e0d1bdc43e7feb753a3ebd6
  • Size 45KB
  • SHA256 3242b78318484571e6727e40d9a3e5cb36349e7a3e0d1bdc43e7feb753a3ebd6
  • MD5 cf3512f8cf125f4be1f624b180044fc4
  • SHA1 94e0e4a6697bbad4c038c55f1c404c78e34d25a0
  • SHA512 6edfe5faee2568d6e2fda303f65deea1be1e2dabafe90f2fe881dbd346aaf24794fffec5933d674ba3fa190e20e56c7fdb574ab0fab52e51e83656993d94b281
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYsZbtDMQPI8rjbQgX3i4QWFy78atBDZ0x:8uuSpTgyf2UJk8/bXXS4Fjwd0x
  • TLSH
    T1C8232B0037D8812BF2BE4F78A9F26145867AF6673603E54E2CC451DB1613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2