Extracted

• • Target
    97710e27d1a4237470dfe4417eed4d7af1ff4a38391ca0da951b326af7175b3a
  • Size 45KB
  • SHA256 97710e27d1a4237470dfe4417eed4d7af1ff4a38391ca0da951b326af7175b3a
  • MD5 b2ab3955c46c828ed271215a142037cf
  • SHA1 e6adbaaed54562f15cfe7d05af76dbf896838c4d
  • SHA512 dff40eebb521e59825da46b0bd267fbd6941d95733de1716cb6db3dd99f5591032010d3955c4afdf1de8ceb3fe13d291b9ba32841674ac4bd9101ef0eafdb1d1
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvZTohEaSPI8zjbHgX3ikcjZJuNVLBDZEx:MuLAZTnbg2O4Ea783bAXSks8/ddEx
  • TLSH
    T125231B003BE8822BF2BE4F7858F26145867AF6636603D64D2CC451D75713FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2