Extracted

• • Target
    d3a1440d5f2fb06f755ded901b86c78245451126cbb89724608288b27d309464
  • Size 45KB
  • SHA256 d3a1440d5f2fb06f755ded901b86c78245451126cbb89724608288b27d309464
  • MD5 5e480732fc8d4a236b6035363e154c6f
  • SHA1 999c200d5e00440c6997de5eeb9143b6d7ad6290
  • SHA512 3243f71542418c4288ee08762fcc5f13b3373407689dfb20ae27d3b9990e9cd543196a9f91729acc214085f640740c5ddcd8b7e127e96e425fed3aad99423d95
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY2RzMwcOPIxzjbSgX3iae4nfFWJK29aVBDZ0x:8uuSpTgyf2iAd3x3bVXSaeAfF+t4d0x
  • TLSH
    T1CD231B003BE8823BF2BE4F7898F26145467AF6673603E64D1CC451DB5613BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2