Extracted

• • Target
    1a2aec12899b04cfa85e58ad510187799180c6378c94cf056deba02ed3c372e3
  • Size 45KB
  • SHA256 1a2aec12899b04cfa85e58ad510187799180c6378c94cf056deba02ed3c372e3
  • MD5 567f0e0cd87dc44d0e09ad8b9e7a39f9
  • SHA1 4edcef00ac15fee631718dc3347c5b214da5e327
  • SHA512 b79423d7ab6f2cc97f597fe772e942cfd80b82b08685d911ad951440abcdd8557647cd91f65492e41e462cb02bbf53f677f2dfc697c606ad891441c118d7ed5d
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYsHO9YjoHPICYzjbIgX3ik+EZg4pBDZ0x:8uuSpTgyf2h6kgCY3bfXSDCH3d0x
  • TLSH
    T19C233C003BD8822BF2BE4F78A9F26145867AF6633603D54E1CC451DB5613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2