Extracted

• • Target
    831cb6e20a7be2d8952b3dca09cac94b5117a05861d7861b2fd23c666a9ba6b6
  • Size 45KB
  • SHA256 831cb6e20a7be2d8952b3dca09cac94b5117a05861d7861b2fd23c666a9ba6b6
  • MD5 c99e270ce68f7271152c77b6b692120b
  • SHA1 cd6a2eadc7004a9b8fb9878338363beb1a3649db
  • SHA512 021a7b4c7114d96199f6fef9331101117fb6a5b6647147dec3ec802b9f27da2bd8b3bfb40a3b10c1df47a0af2c0ab14344e7fb04d4a27094cf448c4c769f80c8
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFCm/9GgrOPIRzjbcgX3i7bxKIsJv/PMDsABDZUx:cu7e5TH2A2pm1b3R3bzXS79KfXPMD9dW
  • TLSH
    T110233B103BE8822BF2BE4F7898F26145867AF6A73603D54D1CC451DB4613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2