Extracted

• • Target
    c23ec9fd720cc976c37866aa8a7b94c2b43a47122831098bfef6803ff437508d
  • Size 45KB
  • SHA256 c23ec9fd720cc976c37866aa8a7b94c2b43a47122831098bfef6803ff437508d
  • MD5 28429123c85c3cd548b768b2aa18f905
  • SHA1 9cc50a3026de3867ec7306b5b7ba39d6f7333ed9
  • SHA512 c3fffec317bec1f57cb2e02a660bb669ef754441d29865ca3a49afd2028f95cf2004be445291b6d452b2ba5a7c9eb58b254c2558720208095a12e414ed06c26a
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwtNd3u40cMOPI04zjbKgX1i9zVZPHsiIWwBDZMx:ku40ZTXEb278+M3043bdXk3ZvMHdMx
  • TLSH
    T10E232B003BE8C12BF2BE4F7898F26145867EF2676603D98E1CC451DB4713BC696526EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2