Extracted

• • Target
    709a18977c52d122ce120184ec369b1276031c2db59b016a31270be2131f0289
  • Size 45KB
  • SHA256 709a18977c52d122ce120184ec369b1276031c2db59b016a31270be2131f0289
  • MD5 036aeb210a847a366a359727de7f2b74
  • SHA1 e4e9195c3bd0b3d330b8596f8cb7aaabe2615696
  • SHA512 a57865cef01844e4701ae41c1a4e1b43ab45ae1207f406cfefc34827a4c681a9f8c979321c351a14c071be16425832c3414d437a22673fbd94880c722ba8c889
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVufPLyiObvtkjZPIrzjbqgXTiCktlpop8/1BDZEx:MuBGJTPho2Hf2iyyjWr3b9XOCulx/bdG
  • TLSH
    T1B9232C1037E9812BF2BE4F789CF26145867AF6632603D5491CC441DB5B13FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2