Extracted

• • Target
    405120fa3619bc9659ca753d0bc4a0a778d67a0aa3a8f1f58b5b7274976905e8
  • Size 45KB
  • SHA256 405120fa3619bc9659ca753d0bc4a0a778d67a0aa3a8f1f58b5b7274976905e8
  • MD5 acab85623ff883e48157b4c898d247dd
  • SHA1 f6b960ca636c893acd8414f00e5f602d906bfe1b
  • SHA512 fc31b22380f9b4f2156ca68ec78415fc1dbb714c739daf52697f8837297ac8095a3416bd4235132e33098764f0abdbc826c0db9248069ff281fa7ecd51b442de
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9MCOtTMtPIGzjbkgX3iwAguAqDwKkryA+ddH9BDZ8x:0u1YJTHcw2TRvG3brXSwGD/gyjTd8x
  • TLSH
    T18C231C003BE8812BF2BE4F789DF26146857AF6673602D54E1CC451DB5623FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2