Extracted

• • Target
    216b12dd034b605872d17c9b152062ff8803593e42f5b3aa7c75fd08a2a52b23
  • Size 45KB
  • SHA256 216b12dd034b605872d17c9b152062ff8803593e42f5b3aa7c75fd08a2a52b23
  • MD5 7978b1bdb6da1624d5f99802cb3b1bf3
  • SHA1 6881dd28edf824631a295e5400d08e3dacc1c168
  • SHA512 acef8ac9bc8cf21aabbb0953d6af47343f026e4fc36f2e3ab071223968082c9abd893d14eef7586dcc27203c00a59ef5dab31ae5a368b9cccd9f93ef0ca69e4c
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9tcQSCBznqNLPI7zjb2gX3ilqMKoGshYEt3pBDZ8x:0uPrpT/qY2cc9UqC73bpXSl7GMV3d8x
  • TLSH
    T143231B003BE8812BF2BE4F78A9F25145467AF6633603D5492CC452DB5713FC6DA426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2