Extracted

• • Target
    4408053046016bb2881a9671987770a988a722a385e26f931611c0c1b9c80056
  • Size 45KB
  • SHA256 4408053046016bb2881a9671987770a988a722a385e26f931611c0c1b9c80056
  • MD5 fa788244508aa6144587ec3f10070778
  • SHA1 86b710d05a43f2dcbc010c93b6c50b1c2d3e2395
  • SHA512 bdde405b8b8030c7df0d3892fcb246136613fdb498c60c8d78c90315b0a15d7d1515a6063afae37c6ab36a53ff0de522790c080faccfb1098e1f40164db0e1a4
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9AcQSCBznqNLPI7zjbigX3iO+2VyxxiCXFipM6BDZu:EufspTf2g2Jc9UqC73bFXSO5VyxZF0Mn
  • TLSH
    T150230B0037E8812BF2BF4F78A8F26145467AF6637603D54E2CC451DB5713BC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2