Extracted

• • Target
    459b1c624ad2dee9c9a52add3e5fdb4cf6f7d96a6793b0cbe42294784361767e
  • Size 45KB
  • SHA256 459b1c624ad2dee9c9a52add3e5fdb4cf6f7d96a6793b0cbe42294784361767e
  • MD5 9911858af7960416575a82b64418385e
  • SHA1 1136b258aef28423760884812167ed529e09cf15
  • SHA512 cce1f876a8ae246c31876b95368c7789cfa9036ec8107204747c51d938c478a6a8aa4f04f69b87075f046bfbc912bd4732c866cfc51c49dfd3b0dbb542213ace
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCSwTMjPIuajbsKgX3irBatKoWPgBi/2BDZ0x:8uuSpTgyf2dg1u2bsdXSgkYBRd0x
  • TLSH
    T1C8230A003BE8812BF2BE5F7869F26145867AF6673A03D58D1CC4519B1623BC586427FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2