Extracted

• • Target
    04a50e04c27821822ac4aa0a8078039a30fc2a70573bc9f32e54be2e86bdf860
  • Size 45KB
  • SHA256 04a50e04c27821822ac4aa0a8078039a30fc2a70573bc9f32e54be2e86bdf860
  • MD5 a558899b3406a82229228c4ca0f77d35
  • SHA1 fe6165f03266d9532595b4d58d626e7a41d19690
  • SHA512 6ea713a14fc93fc81e6699965a933cfe520fbe6b2370359b7cd5a46640cb97f455c5e542f6ef7319476a3be8d838bd0b7fd2589af60cfdd37e96c2e223fd9088
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVPmaPol53APIkzjb4gX3i4MPinrmkSUBDZkx:suJdpTPdI2efob3lk3bvXS36rmKdkx
  • TLSH
    T189232A003BE8812BF2BF4F7899F26245867AF2636603D64A1CC451DB5613FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2