Extracted

• • Target
    cd4a1e8dbd2f4b673d87a3388d1b033e0d96141237120997bd1f8bdaea650d51
  • Size 45KB
  • SHA256 cd4a1e8dbd2f4b673d87a3388d1b033e0d96141237120997bd1f8bdaea650d51
  • MD5 28b7c224ba0886fca14a8fb8e360fb8d
  • SHA1 698ae2e70e5e1898e691a224a1b2a3590fb17605
  • SHA512 02311004b5dae9e75ad81dee550c772c225e41cb32c4885c1e20fe549cca4a842032375852225d2ac3eba706fe3722eb6909d78958897891139dbf8f4bc1dd35
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwvBl3u40cMOPI0GzjbAgXziwxfXJv35CYBDZMx:ku40ZTXEb2Fk+M30G3bnXuwpZfYedMx
  • TLSH
    T138232B003BE8C12BF2BE4F78A8F26105867AE6737603D54A1CC4519B5723BC6DA526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2