Extracted

• • Target
    b776487f9522b91e1730570029392f1c0bce6a4e2b0e24702b713cfb9d7fbd2e
  • Size 45KB
  • SHA256 b776487f9522b91e1730570029392f1c0bce6a4e2b0e24702b713cfb9d7fbd2e
  • MD5 f2571e1a59159c471d2c9beb4bd1c342
  • SHA1 8416ca52aba1af51ea05817d5084036db42937ee
  • SHA512 b247727577b4f4597f1d57301473d1961e5772369d48ceff8a0f00fe6b847a2f70ad5d6aa36573256947f3394699c6839c0943206f17df9080b94596602081d9
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4MIz/yPqiPIJzjbhgX3iRWibqf/eS9UlLhn0n9gBU:8uUIpT4vAj2Yc5J3bOXSwOqOS9GLR+9B
  • TLSH
    T137233B0037E9C12BF2BE4F7899F261054A7AB6632603D58D1CC412DB5723FC69A52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2