Extracted

• • Target
    957fd9aea7021078746b6dbc57c74060dfbb67afb77f89b09839902945f0208f
  • Size 45KB
  • SHA256 957fd9aea7021078746b6dbc57c74060dfbb67afb77f89b09839902945f0208f
  • MD5 419b628dafdd9bd8b154010f3259f477
  • SHA1 3748783e64405631bb4964b28d9b9c81556988d7
  • SHA512 b4676cca4c14bfd92aca175e301e954c21deaccd3460f40dd58e7e729936fdcfca2a066e32dd59cb287f06e9b27f2988798631e0e160d521248db5d6a24ec78b
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9jZoQTMtPI4Ijb1gX3ibH/FXLsKz6wBDZ8x:0u1YJTHcw28L34gbSXSbHd7Pfd8x
  • TLSH
    T1CD232B103BE8812BF2BE5F7899F26145867AF6673603D64D1CC401DB5723FC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2