Extracted

• • Target
    18a4c1e03c673b67fa063f7cfb04c114190fb4220db85334d1f91bd987af0f59
  • Size 45KB
  • SHA256 18a4c1e03c673b67fa063f7cfb04c114190fb4220db85334d1f91bd987af0f59
  • MD5 9aa9324b5ad5b8d56c0ac14be6be7bbb
  • SHA1 0d27c743d286559992cb56166f32f35bb763f090
  • SHA512 bb76878356807631f27644f4879b3b34d9c3bad14589c76d3f91263040ac1b7fb520877cfe057164d822f4b867988ab0d9ff89373a3f66f39ac31aa148ee58a6
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4T9YikqHztOPIUzjbTgM3i7OZ7sGLnsr8BDZ0x:8uUIpT4vAj2XalK3U3bMMSqZ7sGIrad2
  • TLSH
    T126232A0037E9C12BF2BE4F78A9F26105467AF6633603D64A1CC451DB5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2