Extracted

• • Target
    4ac68bd84ea7e0fcf996d5785f6676d9020501d090006108c95613967acd6f55
  • Size 45KB
  • SHA256 4ac68bd84ea7e0fcf996d5785f6676d9020501d090006108c95613967acd6f55
  • MD5 649b80080b4ca3c8677530114fc0e895
  • SHA1 4959e1bda6d4e3a24b62cb58f6a76349cc65abb9
  • SHA512 71ae6f479dffd58e5504f15c76d5e2089a299385a5f5bcbfd2198cffa0bf05232c37bf721eb2bc4bfe8ea70e6873733d6287aedf990b89c12958ddf6f790cdb0
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAfmaPcl83APITpzjbxgX3i+ZPTylsjpRBDZcx:UuKWgSJTwRf2vfcS3lTp3b+XS+hSsjpk
  • TLSH
    T1C7231A003BE9812BF2BE4F78A9F26145467AF2637603D64D1CC452DB5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2