Extracted

• • Target
    4279399e947763a1a23b8af86d81405591c4a2fdfc268586b99a355112a6bf06
  • Size 45KB
  • SHA256 4279399e947763a1a23b8af86d81405591c4a2fdfc268586b99a355112a6bf06
  • MD5 b3f50cf3e1b40dd38d46daf86936e822
  • SHA1 eb1b7123ed03927eb96d538944636ae40dcf4b22
  • SHA512 030aabe24bd51c95566ac628b16c53f7df5abadfde10a52f199bebc01d53a3eca4efd3601258f8cd80fd3ea449c5511aa4ff9ffc418c2c05a8dc89d43393b33c
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlcNd3u40cMOPI04zjbggXHiWUN5oLU3UcYBDZMx:wuDWZTpMZSB2r8+M3043bHXCZYLKedMx
  • TLSH
    T181232B003BE8822BF1BE5F786DF26105467AF6633603D58A1CC451DB5A13FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2