Extracted

• • Target
    d1b57ee9bf786a3353a13af72f23d500bd017678babbb1e71f888e312c642d93
  • Size 45KB
  • SHA256 d1b57ee9bf786a3353a13af72f23d500bd017678babbb1e71f888e312c642d93
  • MD5 77cee441431e899606e8776b895dea57
  • SHA1 462e0537894073ed7cdb844c5e83a7f4a255e0df
  • SHA512 6ec5d2d179cd28873131556422b8fdd9a6d558964737e1a94dd6f5d0cd9503d66da59fca95720e46c135065f48dfb5e6ae587e58841ee45a35be132b2d7676b5
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9mdR3aI6OPIuzjbUgr3io7uNIkxyl2mJwqBDZ8x:0u1YJTHcw2Zjqb3u3b7rSWuNfylTJd8x
  • TLSH
    T1A0232B0037E8822BF2BE4F749CF26145867AF6673603D54E2CC4529B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2