Extracted

• • Target
    a603b29d093adc5fe9caf117caf41704ab97cb924e99822ee7e9e2b7409d90fd
  • Size 45KB
  • SHA256 a603b29d093adc5fe9caf117caf41704ab97cb924e99822ee7e9e2b7409d90fd
  • MD5 3e7be8c501c2e59d59b052d84a289aa6
  • SHA1 472c75237425778f95bd95f5b0512acb3db04200
  • SHA512 83ad14e8fdb96dc90dadd2ff7a8a00aacb76131e1e2dc14b873ab11beed4972807e2a6fa255033d72773700b5a71714cb45c5a4cec78925566beb4871b69c74b
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV1xGZGP9HuPI5zjbNgk3i3bprIeyB7nhVxgEYdIKtBk:suJdpTPdI2UGa353bakSLFIvVxDNedkx
  • TLSH
    T1AD232A0037E8822BF2BE5F7898F26105467AF6637603DA4D1CC851DB5623FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2