Extracted

• • Target
    02442a8501e341698b604907ddeeacf862997988be95639c99762371b8bb8455
  • Size 45KB
  • SHA256 02442a8501e341698b604907ddeeacf862997988be95639c99762371b8bb8455
  • MD5 6e3d9e44d66d73591af52fc77f99de0a
  • SHA1 5665039cf5790252c3b849766412ea6e4ae4fb69
  • SHA512 4a79fd9fba5aeb46fc44366dc4eb21c988c74f46f863ff808af63428d9469ed4c95944897519a0a718561bc38ca77a4c4bb85729108561d220a2226ed6ab1be1
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9AcQSCBznqNLPI7zjb2gX3igaNWD4Hk/EsPKbRBDZu:EufspTf2g2Jc9UqC73bpXSgKWD4HSEsp
  • TLSH
    T1C0231A0037E8822BF2BE4F78A8F26145867AF6637603D54D2CC451DB5613FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2