Extracted

• • Target
    814fe67de7c89cfee50aade2a2e16c62e138d7f9da20492738887e3656a65a4f
  • Size 45KB
  • SHA256 814fe67de7c89cfee50aade2a2e16c62e138d7f9da20492738887e3656a65a4f
  • MD5 3aabdd026868d670d66b6505c8d3ddc9
  • SHA1 1a9b9374f62d7f4fd4cd7297d383eb8e65843821
  • SHA512 782b39b3f06c9a48520c1878feb6e6ab048115598508d6cc18b96cfa1cab232af0b218b2d62ab34de58b2441f59b0f38756a15360651e62b5b6d701062a8e173
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwXzdAAyPMlL8TfPIMWzjbggX3uonaogT7oJ6BDZMx:ku40ZTXEb2PlvlL+4MW3bHXeuaPvo6dO
  • TLSH
    T191231A003BE8812BF27E4FB899F26145867AF6732603D94E1CC451DB5613BC6CA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2