Extracted

• • Target
    1449492be5c70d8d3942ba89ae53a4d88c35cc40c94c13c86c348996d7492e5d
  • Size 45KB
  • SHA256 1449492be5c70d8d3942ba89ae53a4d88c35cc40c94c13c86c348996d7492e5d
  • MD5 469de739faee9142aa3944becf75ec0d
  • SHA1 21efc3402fb279ce24911f89e883111629669a21
  • SHA512 f505c7e4956d6cf9882b9aacc38b5306296b122d09cc7ef4af8034a2aa2490f95bc47c10e399a947e9b3b035ebbd6acf08ce9ea035f1b1364181ad03e88d513e
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1N8V1RpPEcPIMzjbMgX3iUBKqRyebqRAlN1UabBDZUx:cuR0JTPjY2+8VDZEhM3bDXSUBKOOCNqZ
  • TLSH
    T1A9233C0037E9813BF2BE4F7899F26145867AF6633603D64A1CC052DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2