Extracted

• • Target
    8947f17957771cc5459ec9d98e064eac3584ac551a1685360a29a1926298114d
  • Size 45KB
  • SHA256 8947f17957771cc5459ec9d98e064eac3584ac551a1685360a29a1926298114d
  • MD5 61042995e61981bd5f0294f7ec52602f
  • SHA1 a5807a233931c88ace4569ae2d671fd569d18187
  • SHA512 3621d93a59830ac5d38dbb4a300c83882d027618cfe0e2501ad72e1f9930a527180817c53bb050b1420e299d8cf05b9a156de72a1d58d92e90828d333c65dc91
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ORzMwnOPIZzjbwgX3iKSBt2UMdBFBDZsx:EulCJTHl42PA+3Z3b3XSKSBvMbLdsx
  • TLSH
    T178231A003BE8812BF2BE4B7899F26145867EF6673603D58A1CC451DB5713FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2