Extracted

• • Target
    0395943f357f34b8fc687c9057896fca916198b443cd0e4a6c3a720cebda8348
  • Size 45KB
  • SHA256 0395943f357f34b8fc687c9057896fca916198b443cd0e4a6c3a720cebda8348
  • MD5 d2f3e5a72fee4dbeb991b83fe6c32311
  • SHA1 d03424a7c95fc09edfada6e90fa3389f45fffe5a
  • SHA512 510de611ddca21d872a5d6cecb53a6236b44abda44229c1bba3d8fbe80f6c16e2176c532febfdd0cd5e08d152f82d43da6bfe8abc64f9407a30366d0c933a896
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAjT2QAm7PI1f2jbzgX3iGzcmZ/mJN1pBDZcx:UuKWgSJTwRf2GT1SbsXSG4mZ/mj13dcx
  • TLSH
    T1BB232B003BE9813BF27E5BB898F26145867AF5633603D94D2CC451DB5623FC6CA426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2