Extracted

• • Target
    888748a41e078a6a6470166541f0de422961fbe8489246dc1f3a39daebac0d14
  • Size 45KB
  • SHA256 888748a41e078a6a6470166541f0de422961fbe8489246dc1f3a39daebac0d14
  • MD5 abc0d938eb60d9f9cfc2e74561596b3b
  • SHA1 e505feaa494bfcf7816328ede474112e9b924b9f
  • SHA512 324c3a7f3f8dafb2e141c76edb9993f87f147869fa7ef1e3c1976c3c5222b548563c4a56c0b82044994a9023ca467de0a7da5f6ace40ed43214b47e150f40dca
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAWVlcVc6GcPI+zjbhgX3/UeuKgsZ7YS4+ZBDZUx:cuqNJTLr62mV226Gh+3bOXvGmZ8TkdUx
  • TLSH
    T17C232B0037E9C22BF2BE5F7898F26146867AF6637603D9491CC441DB5613FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2