Extracted

• • Target
    20781ae91999d67d6098d03b5ec8c8c04ff1d9f23bcb53e1a762072b48451d50
  • Size 45KB
  • SHA256 20781ae91999d67d6098d03b5ec8c8c04ff1d9f23bcb53e1a762072b48451d50
  • MD5 01668a1c46a3d94e5bb28388fa145c04
  • SHA1 418a0f5db321ff5f2abecd6f145996faff4ba4d2
  • SHA512 5637f11790bd3b51f08bb0ffb35195e42967540ba950fd4da7e6b0e9b817e5b882db6fb0e910bea02d7fbf34fd348d3986e70364e8eea76e17ff0f3b3b018f94
  • SSDEEP 768:ouuSpTg7GBoWUSH6+mo2qYZGFZQjB4PIFfzjbcgX3iBeiuHML5gTXHBDZIx:ouuSpTgyf2kqF9Ff3bzXSnusL5KXhdIx
  • TLSH
    T1CD232A003BE8C12BF2BE4F7899F26145467AF6733603D94D1CC451DB5623FC69A42AEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2