Extracted

• • Target
    808d2ef2343da20ddf0921a901ea81ace9a3f4e1a0749e116c087dd79161520d
  • Size 45KB
  • SHA256 808d2ef2343da20ddf0921a901ea81ace9a3f4e1a0749e116c087dd79161520d
  • MD5 fe583cdf7814266ea7faa2d93a1745ec
  • SHA1 9e8d419cb449b0ff09176202536d9ca6a820294b
  • SHA512 0a30a852a38a7bcf42c567421eb73ae016cc9c3dd0ff4e8445b4fbf3f702f5112e0157020a2d402a04cc957a604f093c197dd30f33710c989125eac02edfe879
  • SSDEEP 768:5udApTNctooWUS7C+mo2qttiaLzwJAOPIcFzjb6gX1iYR2wpspBtS/nTAjjUBDZ2:5udApTNmU265U23cF3btXkYR2wpsFxKU
  • TLSH
    T1C6230B0037E9C22BF2BE4F789CF26145467EF2773603E58A1CC4519B5623BC59A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2