Extracted

• • Target
    52670b099a8c15e2be2d2338283c0d9d79f952e318969b7544d7c0406413365c
  • Size 45KB
  • SHA256 52670b099a8c15e2be2d2338283c0d9d79f952e318969b7544d7c0406413365c
  • MD5 8c4ce2b02601eaf9d620f28e603bc8cf
  • SHA1 a3b0c27c087a19a9a787a36dfe25c80bc7e3fe5d
  • SHA512 eb3ff3fbd20551cb49a4e93e450c7471c702d785fadcab8f166fd97d1729bd8605ab763222c2cedd90bd81fa938d054901cc525a14e1b2ff4c71f123fbdf9b09
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFGfBohEa+PIDhjb+gX3i1xxVCFJ+DWaKFNEBDZEx:MuLAZTnbg2b4EaHDxbBXS1xxVCzqWjNt
  • TLSH
    T1FD233C003BE8C22BF2BE4F78ACF26145867EF6A36603D5492CC441D75713BC696426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2