Extracted

• • Target
    369160d1e63a917257e4399babac88de618f234e6b49b5f64fc88e75d2f9a5a4
  • Size 45KB
  • SHA256 369160d1e63a917257e4399babac88de618f234e6b49b5f64fc88e75d2f9a5a4
  • MD5 5117602bf5df3556cdfa8f86f92ad8ee
  • SHA1 4c7e272b229f4cce8c21f1119078f99a74216c6c
  • SHA512 528f2259e0a91e4517bf5093ca77e42ef7bd87c3200356f1852053576f650e34d754a6c3acf7fe3547401602c090f15792aa6ad892130bf789455e96253f2061
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9tgzBNMwpGPIMszjbugX3oqvvJjvoTQacgBDZ8x:0u1YJTHcw2ymGYvMs3bRX4qv1kQadd8x
  • TLSH
    T15C232A003BE8822BF2BE4F74A9F26145867AF2673603D6491CC451DB5613FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2