Extracted

• • Target
    0429ce4380bb03169cafc0de46f56bff9f3c09d408699e1bdb443ac3d1360eb3
  • Size 45KB
  • SHA256 0429ce4380bb03169cafc0de46f56bff9f3c09d408699e1bdb443ac3d1360eb3
  • MD5 20eb98aaf2381ad79755b7bc617e74aa
  • SHA1 40ff6c677e8a1711c9091bb2b13927d143bd11eb
  • SHA512 2fa63e578594839da29331052e5fb89cb40d11ab9ee7ee269b1e59c4c425d4d1a8154cac444bc072a59b9b0d3e31803be29ba5d4e5a17474317b2bd07d59b836
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPylF3APIFzjbLgX3irvH+qQUMELryBDZkx:suJdpTPdI2Hfyv3lF3b0XS7H+nSAdkx
  • TLSH
    T1E5232A0037E8812BF2BE4B78A9F26141867AF6637603D64E1CC452DB5713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2