Extracted

• • Target
    ed8e29ba4e3d3bdc6edc774201dc343c1e47952b272e98edb293003b323afbb4
  • Size 45KB
  • SHA256 ed8e29ba4e3d3bdc6edc774201dc343c1e47952b272e98edb293003b323afbb4
  • MD5 b4476c6db76088c7dd1693375c85064f
  • SHA1 76fa95a546ec9e954ab32ec5910e9f7b9f9ee8ef
  • SHA512 35c3d110efba1cc931c4530a1b4b319dbaa0c59a2733648a438a3454e7a937a88b5b0d3f46be6bfd9276981773d5826ac1f46ee5828f5bd1f5e6d240e2e00b75
  • SSDEEP 768:5udApTNctooWUS7C+mo2qt+CHyTtUPI9zjbHgX3iRliuCay/zscux7nBDZ0x:5udApTNmU2Jnj93bAXSfWaIg33d0x
  • TLSH
    T189232B003BE9812BF2BE4F78ACF26145857AF6673603D5892CC441DB5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2