Extracted

• • Target
    a163c080b4c1a3e6f938e29819e8046be4716fa281955815aaa4867869b914f2
  • Size 45KB
  • SHA256 a163c080b4c1a3e6f938e29819e8046be4716fa281955815aaa4867869b914f2
  • MD5 d918bcf75d0c8d721e9c69a56f4ed95d
  • SHA1 794ca31ec0d83e2b195116177f570e92a706155c
  • SHA512 92ccf55e49f0d188e51cb2fe601d57bc7cfaef4351d4b973ddc17cc3b901a570b0f86e2e40375e8e6309fb5fd1c7356180980d5a4e2eeb76086cf349428fc11a
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9hCHyTtTPIDzjbygX3ihoVYfBDZsx:EulCJTHl422nKD3b1XSGVYpdsx
  • TLSH
    T121231A0037E8812BF2BE4F78A9F26145867AF6633A03D5491CC441DB5713FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2