Extracted

• • Target
    b261c3588b89fef76386ae1dc6fc30c7417ebd200e3d7e3c4073522660beec5d
  • Size 45KB
  • SHA256 b261c3588b89fef76386ae1dc6fc30c7417ebd200e3d7e3c4073522660beec5d
  • MD5 7e18f1e67ff001c6d4a6ea829237508f
  • SHA1 84e79a4d9472e9efedc1a285dff0f5e7329da5d8
  • SHA512 54bf43dc98fe4f277a9f3c0f2899766306b341d633ff3006c6b21da1e10be278999812a6e1b130c9b6bb4c0c37f3f05cb1e8ed3f98a20264d73a482117c51b7d
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBqjSOPI/Xzzjb7gX3ioamfd3TGqk6vWBDZsx:EulCJTHl42IyoO3/Xz3bEXSoam3TGI4c
  • TLSH
    T18D231B003BE9812BF2BE4FB898F26145467AF6633A03E54D1CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2