Extracted

• • Target
    19e72f8f61fd5e2a67ed6cce271db42db7ba415dc7975227dcaece311008648d
  • Size 45KB
  • SHA256 19e72f8f61fd5e2a67ed6cce271db42db7ba415dc7975227dcaece311008648d
  • MD5 cdd1a50ccc5435577edfd373cdd131f0
  • SHA1 70d21b10a1cd7cdaff4e237318bc904b3182e737
  • SHA512 2e63b605f8d2764af5b371421f769262fbc6c2c8ec877e42a4bdb070f79c846c738e6b9a128194a8c03e5715bffc4b35c844ce3e3f5db300d5822a80737a19d2
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwi3xY6yZoOPI5zjbagl3iQxu2Y5PhGansnOBDZMx:ku40ZTXEb2euPo353bNlS5cbAdMx
  • TLSH
    T18C231A003BE8812BF2BE4F789CF26145867AF6736603E6491CC4529B5713BC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2