Extracted

• • Target
    a4e8d34d4d6c999cac7d4af73f6f46d53e92e08937c2434e424c7dd4c0eaafd7
  • Size 45KB
  • SHA256 a4e8d34d4d6c999cac7d4af73f6f46d53e92e08937c2434e424c7dd4c0eaafd7
  • MD5 549ac5c10ade79027c7a5ea328d93033
  • SHA1 4e6521aa970c70488e12c5e2b645aabb8e4a26f7
  • SHA512 46cfa9d73c8b3ab4ee9877cca90bc85a8952a6a8b890ab666c9432754518258efc4fa0ad03b6e917d7711743fef64b4ad527293eaa13c110d3d0543beb32c351
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAy+GnnVPJgHuPI4zjboRgX3iQyVmRfWDMuBDZcx:UuKWgSJTwRf2i+o0343b3XSQum4Igdcx
  • TLSH
    T10B231A0037E8822BF2BF4BB8A9F26145867BF6636603D5492CC451D75623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2