Extracted

• • Target
    d1bd739d5da9ed795da0db41efcc7dcca0baf68e38464d71cf2a529fa8684599
  • Size 45KB
  • SHA256 d1bd739d5da9ed795da0db41efcc7dcca0baf68e38464d71cf2a529fa8684599
  • MD5 cc322ddf8efa588ec06643d89c5851bb
  • SHA1 031e533cb6d50aee2e5dee0426b110d6720bb429
  • SHA512 b4eec461ff575d47b693c9dfe2940621d151af6b24464a753faeda6025c37b945e542be348ca0ac36af9a82cb7a95c61dae83f27f4ae46776bcb22ef68ef9259
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qADxJdxrPHuPIbzjbNgS3iBzNM8tkCLl/aKsBDZcx:UuKWgSJTwRf2TxR3b3baSSI8tkCLlaK9
  • TLSH
    T162231B003BE8822BF2BE4FB898F26145467EF6637603D54D1CC452DB5613BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2