Extracted

• • Target
    97034c0bb0b60254a1af55f3d0449093e4bf71546e0e4db4987b4e62a005c83e
  • Size 45KB
  • SHA256 97034c0bb0b60254a1af55f3d0449093e4bf71546e0e4db4987b4e62a005c83e
  • MD5 11878ec01468938281089c3e50088b59
  • SHA1 1252353babfeb71a3bf888bb94cc5717ca0aab1e
  • SHA512 433b2dc6e2be4b6ffd6047a5f8e4c60c38c0b8acb736b8bceccd4ac22d6d98a022b9bdb3a86de31a7dae0642cd77293f0d87ceea9274ad7917f5603ed541768e
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qViqyx0OUUwdrxIkDPIOzjb9gX3ijnYRaQJ35YpBDZG:MuBGJTPho2fqPTNMO3bqXSjnYRx32dEx
  • TLSH
    T155231A0037E9812BF2BE4F74ACF26145867AF6737603D6491C8451DB5B23BC28A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2