Extracted

• • Target
    f1f0c52f3014491c09391ffb75601a2fd8449bf4f676f2e58d715780e3d53cc7
  • Size 45KB
  • SHA256 f1f0c52f3014491c09391ffb75601a2fd8449bf4f676f2e58d715780e3d53cc7
  • MD5 a209cdfbc08fb3add67714ddb24b3c2b
  • SHA1 b0d769c8351203db7055a79f97ea035db3a4de8d
  • SHA512 4aa3be50aeead714915760c92db171c3d48b8bb36bf11c8ff36f95709f0ef3ac2c253295d09e0928de79c6b2a7f2cbf8d7f01a9d1b25c53ecbee62af6720e811
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVPmaPol53APIkzjbjgX3ibNQXU5QIwlBDZkx:suJdpTPdI2efob3lk3b8XSbN2UmIKdkx
  • TLSH
    T109231A003BE8813BF27E4B7899F26106867AF6637603D64D1CC452DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2