Extracted

• • Target
    da15a509bb79e4d4d656ca214eb150e0d0c8b7ee689fd03a8716fac6b97e5a4d
  • Size 45KB
  • SHA256 da15a509bb79e4d4d656ca214eb150e0d0c8b7ee689fd03a8716fac6b97e5a4d
  • MD5 7e491eae82311e71744f17b88eff9c75
  • SHA1 699842f474e1f87f6bb4971ab5dd75921c51db5f
  • SHA512 204c78dcbd341bb48c23367fa0dbac7698cd913c5fc66c48c8b4a1247c28e339e554281ab94a80ced99230d8569e10a9ea6513149fe527dba59e66bd805a258e
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1/qyx0OFUwdrxIkDPIKzjbggX3iTczLUNAZHH27EBDg:cuR0JTPjY2CqKTNMK3bHXSTczANkHHQ9
  • TLSH
    T100231A003BE9812BF2BE4F7499F25245867BF5733603D64A1CC451DB5A23BC68A43AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2