Extracted

• • Target
    087ffbeca1957f3928fa1808197e63787b682f32e38bd10dc863c6411ef339fb
  • Size 45KB
  • SHA256 087ffbeca1957f3928fa1808197e63787b682f32e38bd10dc863c6411ef339fb
  • MD5 a8f16087de5f794d7757de5531956cca
  • SHA1 6f9352ac2aadecc7bea093b3e96845bb1762e131
  • SHA512 56b7d4175dfd5730ae4a10645e45719199ece6cf27e0fa66c887b8626ceac4b42ebcd1efef1bc1e1e6bcdf311bc7ef6ac6fc29a710727df90e3086a8eb866d65
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1LT2QAm7PI1njbmgX3i6ObszRdFk0ylBDZUx:cu6YepTPso2JT1jb5XS6ObsVdW0EdUx
  • TLSH
    T1FF231C003BD8C23AF2BE4FB89DF26145867AF5636603D9492CC451DB5623FC58A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2