Extracted

• • Target
    080e99ad87c27243fb77983a7f459ee2d3e9bc6feaf3806d2a45d815d52ecbf1
  • Size 45KB
  • SHA256 080e99ad87c27243fb77983a7f459ee2d3e9bc6feaf3806d2a45d815d52ecbf1
  • MD5 3bab18f5a78dd6bffa8e5bf0ac8c4ee0
  • SHA1 d0d84f7e902acd5b8ace8f2e9aa472b328b0d213
  • SHA512 1cb36a40451ac9817484482d0ec42b8a37b6135722ce1e40a38c01009f1b466dc4bb89efcfa561b11016e897652eb27f4fb629ad48b090df895b81bf37c42f43
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9IQ6vincPI9ljbygX3iMvy+PMmJ4Vmq+x0BDZsx:EufspTf2g2sKU9tb1XSMvy4MmJ4VPdsx
  • TLSH
    T144232A003BE8C12BF2BE5F7499F26145867AF6633A03DA4D1CC411DB5713BC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2