Extracted

• • Target
    1dae43558ae6d33f3170b74db3df823aa6dbd04a1c6eb8cc8f812c8fb9e54b2d
  • Size 45KB
  • SHA256 1dae43558ae6d33f3170b74db3df823aa6dbd04a1c6eb8cc8f812c8fb9e54b2d
  • MD5 d61919f9bead063cdfac2893b5c0a271
  • SHA1 b48d7a184b87b8b66430db1b7e830abada81aea0
  • SHA512 bfb6b67622c2b9f3ee4b4c5d0844941c1b335864032ad4e49489d4fdfdddba8437e1792170564a09c769a63205cc544c7bef9e1f7d3114be9dc9ddc8c1416d3c
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9PozHy3CKPI2ljbygX3iWsfUNKrW1BDZ8x:0uPrpT/qY2RrR2tb1XSBuKrWbd8x
  • TLSH
    T15D232B003BE9C12BF2BF5F789DF26145467AF6633A03D6491CC4119B5613FC68A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2