Extracted

• • Target
    e57346a0f6be22d1cc43a4792eb4e6a3abd38180a747d7f2e1fbb8bf2a98299e
  • Size 45KB
  • SHA256 e57346a0f6be22d1cc43a4792eb4e6a3abd38180a747d7f2e1fbb8bf2a98299e
  • MD5 91cd7a735b0071304b7803888cbd5319
  • SHA1 c026bf1a755ecfc5d254a292b93f59fed3814184
  • SHA512 2a641a470f53e7bc8c29640d8116c2f29cdb501e619f817589520887ff1b637a840795d9f7ee1317d89b8174110a135ed49d4cd01e5a8e4ac2d0124c299b5243
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFHNd3u40cMOPI08zjbMgXDiTlRzwrBDZEx:MuLAZTnbg2Y8+M3083bDXeTnw9dEx
  • TLSH
    T17A232B003BE9812BF2BE4F78A8F26145867AF6636603E58A1CC451974713FC6D6426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2