Extracted

• • Target
    118d937fbf85dcfaedb5dc6a27e9f0b197367175632e854e2aae4243bb63f359
  • Size 45KB
  • SHA256 118d937fbf85dcfaedb5dc6a27e9f0b197367175632e854e2aae4243bb63f359
  • MD5 f7bc9f696ca01febafbcd62f4c553074
  • SHA1 b835e33764d79be8998c7031b4f8d9993a17ecca
  • SHA512 e041ec6330912858e9567d149233d839b44b60334f5b9afc4f75b61bd01bbf718b632db373f34bf9f24aa2f0030da9055e669a0ba05aaa12546b22d8ece50e9d
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFylsHoPEaMPI1ljbmgX3iTIC+8J4Ec5G3Ms9pBDZEx:MuLAZTnbg2XuuEax1tb5XSTboE53MCdG
  • TLSH
    T1AA232B003BE8816BF2BE4F78ACF26145867AF5B36603D54A1CC441DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2