Extracted

• • Target
    dfb547ea207f8bf5a8a3ce9b7021c0386bcc7551f621bd515433fd47df7a4a88
  • Size 45KB
  • SHA256 dfb547ea207f8bf5a8a3ce9b7021c0386bcc7551f621bd515433fd47df7a4a88
  • MD5 a939189386ce4b9aff625bd9527724cc
  • SHA1 272f7cd8801385db9fedfadf1a2aa6b79f9290a7
  • SHA512 b2decfe7fbf098d3fc42f88e03ab70db618d9d91e7ba4d9584f8f450279132b31d247b05ea232da257b8967dd919a81772bc93f0b9bd55c06bd78b2b04bf8e93
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1bQLDiv/vtNjZPI6zjbXOgJ3iZxHBPN3WeBDZUx:cuR0JTPjY2s2iHLjW63bhJSZ3VHdUx
  • TLSH
    T1BD233C003BE8812BF2BE4F78ADF26145867AF6673603D54A1CC452DB5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2