Extracted

• • Target
    03eb9a4d642b6b8a0180a8657b78675033bfc936056f3d2941030934c19d3e50
  • Size 45KB
  • SHA256 03eb9a4d642b6b8a0180a8657b78675033bfc936056f3d2941030934c19d3e50
  • MD5 c3a8a7be85610bec5bc69e9da5f704fe
  • SHA1 c22febef715ed37dbe78b5a7d0bc432cd66be8c8
  • SHA512 b14b1d8295a5ce9c51e6bbfe51596953e834d929affd74a55d6807e7371a860b143eefef0af20eed9e9e261aa59125ddc6da8031d4a93af82a7c56f1ce64fbed
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA0wZQBKkPIfzjbagX3iOqmMWhXh7L5GPBDZcx:UuKWgSJTwRf27bf3bNXSOqCrodcx
  • TLSH
    T131231A003BE8C137F2BE4FB86DF26145867AF1636603D6492CC4119B5623FC6DA426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2