Extracted

• • Target
    87713da32fbb04e1452545c77b84114bdb5a0d1e25785c5b3f07069fbf92ecb6
  • Size 45KB
  • SHA256 87713da32fbb04e1452545c77b84114bdb5a0d1e25785c5b3f07069fbf92ecb6
  • MD5 0c9e44140a62b6d76f8ab747c8efc0b8
  • SHA1 31831ecb0693a7b38bfa2951d9daa9e15ca86a5c
  • SHA512 0cf9131574d5df55e7d0a52a0eb69607569fc6bb106729fbb6de64a235d6284b651a8fb3db5258e49ec10d0f128bec21ab7fd4137c7ccfe621111881a4076419
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1nfkLyuObvtkjZPIuzjbpgX0ijzVPnF4l3jn7n5poB0:cuR0JTPjY2OfLuyyjWu3bmXRlSl3j7nt
  • TLSH
    T11E232B003BE8C12BF2BE4F78A9F26145867BF6636603D54A1CC451DB5A13FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2