Extracted

• • Target
    1e20e78f8787769d5f12ffdd0bc2c93eaaea0947f66f3a4d6de19cf3b9c588ee
  • Size 45KB
  • SHA256 1e20e78f8787769d5f12ffdd0bc2c93eaaea0947f66f3a4d6de19cf3b9c588ee
  • MD5 5120f4834d6b52c070ff6782d59af028
  • SHA1 0efa3594429de3be3b14d16272c8ae63e0385687
  • SHA512 427571ab215170954ed43ba9747160b1881e89028bc4652cb9241cd7ec3d2b790cb46f112ff32d16099a18deb4ebd1d9f8e16b846a4de36b44b468a539ba3999
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4T9Yikq/ztOPIYzjbigB3iii19T4H/nBDZ0x:8uUIpT4vAj2Xali3Y3bFBS1SfBd0x
  • TLSH
    T13D232B0037E8C13BF2BE4F789DF26105867AF6633602D6491CC452DB5623BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2