Extracted

• • Target
    81b923633d07fd0d60e20d37e33d295bdbac879f2e80d4dd5b9ef889a028ef2c
  • Size 45KB
  • SHA256 81b923633d07fd0d60e20d37e33d295bdbac879f2e80d4dd5b9ef889a028ef2c
  • MD5 114174d6f6d0ed61240a28a47574b9bc
  • SHA1 fa790d15320ec262980493840c4a91b20df7f448
  • SHA512 d57cb07976cfa3ac71dfe39a836a17f428920d505d250b551573072c93ce50607e3f07bdf55cd29e75900f0c3879dfd2af7a3f8165fafd86c600a6a888f9fd9c
  • SSDEEP 768:QulLJTEs+EgWUKJTGmo2q91iaLzwJAOPIcFzjbngXOiaWUg1T3jLJYG0IBDZTx:QulLJTE9X2C5U23cF3bgX3aWUg1bjLJN
  • TLSH
    T13C230A003BE8812BF2BE4FB899F26145867AF2677603D58E1CC4419B5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2