Extracted

• • Target
    f1f4d1ac6116df1852be252028a12d12bcd0e3028a08cdbf1d3cd7012bb11335
  • Size 45KB
  • SHA256 f1f4d1ac6116df1852be252028a12d12bcd0e3028a08cdbf1d3cd7012bb11335
  • MD5 d8502a90010e73f05e8e6621689bb735
  • SHA1 6ed84cf4ec45be8bb5133e730216804157a421c6
  • SHA512 45998cb17f27227e5fe5a00cea1ac39aafcec21cfdc36c8bec0e74dc275dff5ae1f5d3deee4fd6237a544178a5225cb9460ab94c8b77298108b0f156323003bb
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qV00eUNEARViZPI6zjbzg3k3i0Cm8U4exNcptBDZEx:MuBGJTPho2jUe+iW63bsUSmfTbcpjdEx
  • TLSH
    T150231A003BE9812BF2BE4F7898F26245867AF6636603D5491CC451D75723FC6CA43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2