Extracted

• • Target
    65898edaf0e6d7a57e0c05c831640723b4f442a212ac6142abfabefc20b8ad92
  • Size 45KB
  • SHA256 65898edaf0e6d7a57e0c05c831640723b4f442a212ac6142abfabefc20b8ad92
  • MD5 5f7043a0f9474a2fb30a6a1cfeadfeb2
  • SHA1 14e1365a3d0c12d4284f7c485e0a09dabcc0296c
  • SHA512 27468b63c44cbf9c4e04f27dd157fd13baf0e9e37f39fc3aa0d59181c254e275ed6ffc965335602ee9efa59f5bb53ba88c8ca10d3e803a3e7753d693388fce10
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyL5P02FUFdxYkk8PIczjbWgX3imzlxgM37gwmBDZG:MuBGJTPho2/LDmWBc3bJXSmzjgU7gBdG
  • TLSH
    T1BF232B003BE9C12BF6BE4F7859F26145867AF6633603D64A1C8451DB1A13FC68A43AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2