Extracted

• • Target
    764ab0f963a49f5a49b07313cdafb7e0e3affc02b3f075fc8435462b3878837c
  • Size 45KB
  • SHA256 764ab0f963a49f5a49b07313cdafb7e0e3affc02b3f075fc8435462b3878837c
  • MD5 d850340cff25597b0d4e526ddb8974e2
  • SHA1 a3de5d24339e4aec277b52933a5197ab700b16a5
  • SHA512 c64dd2cddf2a7bd2eb9c869b15e88c20d8b460b93b261cbe37d6b0372f2c6b7b75ffcf2594c7ef03ad76a16969a68d4f4773c0445055130ee818be114a3839b5
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHy/aKPIbWujbagX3icSMMFxwVcBDZsx:EufspTf2g23nhbNbNXSRM6dsx
  • TLSH
    T11F231B0037E9C12BF2BE4F78ADF26145857AF6632A03D54A1CC4119B5713FC68A52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2