Extracted

• • Target
    429646e9c29871b69e950afffb77e644957e641c1e4b509775a47ba9daaf0927
  • Size 45KB
  • SHA256 429646e9c29871b69e950afffb77e644957e641c1e4b509775a47ba9daaf0927
  • MD5 3ff1081c00d58846b126fc2e9fc37447
  • SHA1 c95391e5a09ce728e25b8b8bed961a9ce11b7145
  • SHA512 ce1349e6992e2db32d51b096c04bc975b46fd91eaa0c4285383901d16643663dd2db466eb150f263cc6bf09689083aeb465bbb8b8943075bc409cd1bcd700e7c
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV3HE4eVoOPIGjzjbTgu3ip+38eNSKpS4bBDZUx:cu7e5TH2A2EU1o3Gj3bMuSk8YSKHdUx
  • TLSH
    T1CC232B003BD8C12BF2BE4F7899F26145867AF6A33603D5491CC4529B4713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2