Extracted

• • Target
    090a138d6333568517566887287a7f34452af906980deb33c07f047a2c6f8337
  • Size 45KB
  • SHA256 090a138d6333568517566887287a7f34452af906980deb33c07f047a2c6f8337
  • MD5 e8abc8745d8f3262c66e1e14119ba294
  • SHA1 af5c580d01c256a21421fdefd320a070f9e938f2
  • SHA512 f84c691539d1622b1cbb77681a842e8e2d9f208ee056a98b0237158b4fc4c8ab7dbb566a19703939e78ce114e046e5d33dcafc88ef4be5d3316e01aa9826e5e7
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q9i9Y6kq/zNOPIyzjb6gF3i7hNSRyQ+k3BDZTx:QuflpT8Hv2/a9C3y3btFSbp+dTx
  • TLSH
    T1F4232A0037ECC12BF2BE5F789DF26141867AE2672603D6491CC452DB5723BC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2