Extracted

• • Target
    853b8b23c75d7df229c0dfcee8a29adbe2371c70793ef17bba08e3d8c80d59b3
  • Size 45KB
  • SHA256 853b8b23c75d7df229c0dfcee8a29adbe2371c70793ef17bba08e3d8c80d59b3
  • MD5 0ca31850374582ed515bca32866867c7
  • SHA1 84d56207ef136d9ef0cafae2c2b46a680cf45c8e
  • SHA512 90503658478a9d2e8f6ded5960fd10acfe3ea880a400c0b3f35a2aa5e43cfa8b7a2af2a633490a46c1b5a1f386a3bca4ec3030c6bb81151df545a9cc29c65dbf
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvZTohEaSPI0zjbPgX3iZXHSdwAQO+X/BDZEx:MuLAZTnbg2O4Ea703b4XSZXyd0ZdEx
  • TLSH
    T184232C003BE8826BF2BE4F789CF261454A7EF5636503D54D2CC4429B5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2