Extracted

• • Target
    158b33b02aa25cf2d97aa2b2f76d30c3421bb756dd3aeb6ebc880e6d188efff1
  • Size 45KB
  • SHA256 158b33b02aa25cf2d97aa2b2f76d30c3421bb756dd3aeb6ebc880e6d188efff1
  • MD5 64407fdaf34f3378fc1f00c5f1336309
  • SHA1 b67d9dc861fff28a95e76f891c4b4f5a515d0d24
  • SHA512 c088493ceedb09f6aa6fca62cc53447845d16a4d0b148403fcc1d6be2b2958b3a43361435f0168a9c8aaf249a1650ee5b7063cbc5823917f5a7731e4913c6c3c
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/NYssPJZOPIczzjbNgXEiaTwBaazv/cx4IZBDZsx:EulCJTHl42eHIf3cz3baXBMwBLkxtHdu
  • TLSH
    T1AB232C003BE8822BF2BE4F7898F26145467EF6633603D68E1CC451D75613FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2