Extracted

• • Target
    a73afba7f8626f811763a8a24d36d9a012a8968375767dad9092672ee2626672
  • Size 45KB
  • SHA256 a73afba7f8626f811763a8a24d36d9a012a8968375767dad9092672ee2626672
  • MD5 87d0f7867aa52c044d7d9e7bfada8ea2
  • SHA1 d95b777f145de247636fab4b175c542086867d53
  • SHA512 bf088ecbf6d1d0b1ad42b1819a0ec68ae93ba12ba0a44b8b8211f0d9bdbd90b3ab8de8efe1061d909cf60c493b0a0d10bbdad0a1af8da5c0c369f3a221ba52db
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1mGsGx8OHuPI2zjbVgk3iUjqLvcJy5YBDZUx:cu6YepTPso2rez323bykSUGLi5dUx
  • TLSH
    T1B3232B003BE98127F2BE4FB4A9F26145467AF2677603D68D2CC441D75723FC68A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2