Extracted

• • Target
    ab1548e2eb0d18c24cbf9496c6bcc175db4b81a16b321582829feb1ff8047627
  • Size 45KB
  • SHA256 ab1548e2eb0d18c24cbf9496c6bcc175db4b81a16b321582829feb1ff8047627
  • MD5 fafb4d900e40f480eb2aba1849af3538
  • SHA1 3dbab0de400ba781fbe9282c173cdb160b4a31eb
  • SHA512 cf0a2e8bf47e41140badaac79b225dde78374d0b560604109d420048469a499608d3a204764443b21f1e8c24df2e15c1a36dd07d631aaa138a0706ed6e14dc78
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrzjHynaKPIsSjbBgX3ie6/mB2L+bRPKKP/yteRxB:5uSy6pTpoo2onZs+buXSxED1PKKPaykU
  • TLSH
    T1FA232B003BE9C12BF2BE5F789DF26145867AF5632A03D64D1CC4119B5A13FC68A126FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2