Extracted

• • Target
    3a1a978c8e948252d6f5a6a3843454ba375f1b8af17088eb1968fb16ab1a34fb
  • Size 45KB
  • SHA256 3a1a978c8e948252d6f5a6a3843454ba375f1b8af17088eb1968fb16ab1a34fb
  • MD5 9a6155f0a995b724f6f8a0cdd8516a61
  • SHA1 19262a1db54c7487f1a5b3cd8f49a6d892e7f6a9
  • SHA512 efa633fb5dcfd39948e117bfc2a56c62308ab321b5732bad725c828257b341bf89972bc49a59d080058ffa179bf495e4b69590d4a4f768d16b5f8187448c4f13
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAjT2QAm7PI16jbbgX3iUI5JvqKGh0fqQBDZcx:UuKWgSJTwRf2GT1WbkXSzJvqKGefHdcx
  • TLSH
    T160231B003BE88127F2BE4FB86CF26145467AF6636603DA496CC451DB5623FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2