Extracted

• • Target
    d81302e8284f2cbc3a66ea03cce401a1786b234151f1f62bcef285440531ea81
  • Size 45KB
  • SHA256 d81302e8284f2cbc3a66ea03cce401a1786b234151f1f62bcef285440531ea81
  • MD5 9954f780232e1873e788563f64b73c07
  • SHA1 eb629714ed4ff45e94f028f5b18588943cd6a6d6
  • SHA512 8a10ba05355ef50072bf13d00ffae362c953a2f5deef55ade131690015a18418e6474c0f9d58279c0c63bad97247c12683a97c0064fbedb1c25e6f774728d3f0
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFP3Xo5EayPIRzjbggX3iqjtYhJOzvD7vBDZEx:MuLAZTnbg2YQEabR3bHXSutwUD7ZdEx
  • TLSH
    T1C9232B003BE8812BF2BE4F78ADF26145867AF5636603D6492CC441DB5613FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2