Extracted

• • Target
    59670e93feea4f3e9256fbd3a39ef9c27a9a153bd8eae83dc6d7d09982348274
  • Size 45KB
  • SHA256 59670e93feea4f3e9256fbd3a39ef9c27a9a153bd8eae83dc6d7d09982348274
  • MD5 1227aadf09f70960bd38e8eb33344146
  • SHA1 22aa4bfc04d8390f6de2a6d8ddba17df4ef1db28
  • SHA512 1811d5a88dc446d3c75b652d3e7786f43a86ba2530deca74942648ddddcbe8c4a38d240a892748b577a0b9fb87ce075d222795ae4bca571a61b3cbeceb10e074
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFw3HO4SNMOPI0azjbggX3iIPn32WG+n+3dfkm2BDZEx:MuLAZTnbg2R+JM30a3bHXS63Jn8jYdEx
  • TLSH
    T192231A003BE8822BF2BE4F78ACF26145867AF5637603D54A1CC4519B5613FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2