Extracted

• • Target
    18c599343031405eeb84d87f0a2edeba9a8486928a9ffcb18bf37d25b5531a1d
  • Size 45KB
  • SHA256 18c599343031405eeb84d87f0a2edeba9a8486928a9ffcb18bf37d25b5531a1d
  • MD5 76efa24b099313485e4e27416b34273d
  • SHA1 509b710caef3ddcc21470b299de6c28cc6e31cd5
  • SHA512 7a4af9dcc26d5a798afeb3e896683a93fc898f60ff3afb4e8e6cf7bafe255a57fba6d9438d2437f17464faff999e3e3b8e0a8d0d3502b702c0bd252131ec3ef7
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVpuwZQaKkPIwzjbSgX3iNk8V1LlakHA6LBDZkx:suJdpTPdI2QIw3bVXSNk6ZlakHBdkx
  • TLSH
    T1ED231A003BE8813BF2BE4F78ADF26145467AF6636603D64D2CC451DB5623BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2