Extracted

• • Target
    ef627a13ec485cb3d055cf2f3f96971b0fa2bbbfaf7eaa7b1d2293c6a2dfed61
  • Size 45KB
  • SHA256 ef627a13ec485cb3d055cf2f3f96971b0fa2bbbfaf7eaa7b1d2293c6a2dfed61
  • MD5 4555106cb1231f637f9d5da8ccff8f18
  • SHA1 b7021041d1e2e04c3c95a92b92d47628f1790364
  • SHA512 b708e2197c214229af7cdcb6a42ee3bc980f4a72b203da50d1a94f976dd861c2d08e6ef72a7ea43ed5c1e7dcb328f8a37c258f2baeb42c74fa14b5d45af10415
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFQ4UdA8Mal58FnPIMHzjbtgX31GN92hNirnvBDZEx:MuLAZTnbg2uUp7l5wAMH3b6XFGN92hN9
  • TLSH
    T18E232A103BE8812BF27E4BB8ADF26145867AF6732603D54A1CC451DB5723FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2