Extracted

• • Target
    271c08d2e5515df73a22c63f9323e9695b84c84b443b1103b7b14c24b5670a40
  • Size 45KB
  • SHA256 271c08d2e5515df73a22c63f9323e9695b84c84b443b1103b7b14c24b5670a40
  • MD5 f48cd80a2b3cbf3a3c45e8a0d6b517df
  • SHA1 c6313ef545c6104c2283808106eff1a20ec13418
  • SHA512 91abed92e32640119d7504ba048ac140d70cb7b5c96fa7cbe1ab8a372dc18857cf3a04d88360dcb35643554f7727bc20686b0043ca1c35d5b741e36d440b87b2
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFTlsHoPEaMPIGjjbAgX3iuoGvadsH7dIHHBDZUx:cu7e5TH2A2muuEaxGHbnXSuoXd+qHhdW
  • TLSH
    T1F9232A003BE88227F2BE5F7858F26145867AF6A33603D54A2CC451DB5713FC69642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2