Extracted

• • Target
    803ff2bfe578cbb4465c54c8378fa5db3da7f330dc95cf5c7e66eec1b2bd9feb
  • Size 45KB
  • SHA256 803ff2bfe578cbb4465c54c8378fa5db3da7f330dc95cf5c7e66eec1b2bd9feb
  • MD5 f6d88f881cc4521cf406b7360a74aab3
  • SHA1 fc8f33d161f3e2807bbe099b25dfe6c886ffdc93
  • SHA512 83943d3e1c1ae56f3e0fd619f9938edae9d9ee44dff825698ef1c3f894df76eb4a49800a9e2d6b3f5dd7c0d3bb9e395830943463cd422c90606a39a1e02e01e2
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYgCXtTtSPIjzjbzgX3irVOA6kNZioMPlrT2BDZ0x:8uuSpTgyf24wxj3bsXSrVOaNRMPlHYd2
  • TLSH
    T14E232B003BE8812BF2BE4F78ADF26145867AF5632A03D54D2CC451DB5713BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2