Extracted

• • Target
    de3129e30576baba0c9186bc5092cc8ab6fde7c41b37627e493a3f20785b1e16
  • Size 45KB
  • SHA256 de3129e30576baba0c9186bc5092cc8ab6fde7c41b37627e493a3f20785b1e16
  • MD5 e5d7f8267c8801f9666539f3c0790e23
  • SHA1 b285200e3ab14be13a0eb1f5ae2b58eb917e8a6e
  • SHA512 17bb8a76d3edfa1aef11ef182cc6a63007e20ebba17ffe81c0e5894acc5ba64c9dcb096a2c483887ad339f6129d2c286e92b6a96221bc2884d3c2a92f1167548
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4zSzEynzuOPIazjbCgX1itzLk/92qHKpBDZ0x:8uUIpT4vAj2nSIh3a3blXkpk/92/d0x
  • TLSH
    T1F4232B003BE8812BF2BE4F7899F26105867EF6637603D5491CC452DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2