Extracted

• • Target
    73e7ab2129f935d8feb6911ecfb24d22c932e898b14ea49a029fa7c606c364b3
  • Size 45KB
  • SHA256 73e7ab2129f935d8feb6911ecfb24d22c932e898b14ea49a029fa7c606c364b3
  • MD5 4e969049c67c40ee0b842a44148e3cab
  • SHA1 c859d198e76935869ae5fecf047280a012d083e7
  • SHA512 1306c952905ddde12c32995a8c97cc5a1ca2a831c691776d507c5a98aae5b913df167aada71e45e55d788b62448a5f60bd183c641b772dd15b3acdc94f34a1c9
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/rLzlJAOPIc6zjblgX+ilCUBTmTkPOtBDZsx:EulCJTHl42ePp23c63biXHgpkPOjdsx
  • TLSH
    T12C230A0037E8822BF2BE4F7499F26145867EF6673603E64E1CC4419B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2