Extracted

• • Target
    35cc042f1557bb1f7f697716ec5d15b9358c7c12fa60e4e08c671ac8c304ba2e
  • Size 45KB
  • SHA256 35cc042f1557bb1f7f697716ec5d15b9358c7c12fa60e4e08c671ac8c304ba2e
  • MD5 bee667f54880248d771b3f3034e80859
  • SHA1 66fbf2eea65928185f333849f5bd197fb2a4be68
  • SHA512 652df099f95b143f4a399f183ef4589d9ded417d9ec4608cd87f7798de56ae3c6d388d8d44a9e33e860cff1c550a9add66600f47590143866a02fe1b05b6cb07
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1JGju8eQlZwZPI5zjb0gXzi7tzbphihpoUTSQBDZUx:cuR0JTPjY2sGjuVGwW53bbXu7JbgphTq
  • TLSH
    T141233B003BE9C12BF2BE4F78A8F26145867AF6637603D54A1CC441DB5613FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2