Extracted

• • Target
    89db5ef8e776bc3c9fc32e1b2ec9e05f634fa8197989b2a921e459e3c26a0080
  • Size 45KB
  • SHA256 89db5ef8e776bc3c9fc32e1b2ec9e05f634fa8197989b2a921e459e3c26a0080
  • MD5 bf138031796a55fa6437fb3e4d753a13
  • SHA1 98d79a23d7e85865717e064ae774a9193f7e8877
  • SHA512 8a95b901417f0f41a1ca88a96a03501f338c2b17a84ba46c024eec826394afd36909e59025dbf05082f0e289117cef686dac6118cee7b6bb3b3a89cadab4e3c3
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1DxJdxCPHuPIXzjbCgh3iJsYoz+3Z53XiBDZUx:cu6YepTPso2eZc3X3blhS0YsdUx
  • TLSH
    T139232A003BE9812BF2BE5FB898F26105867AF6673603D64D2CC441DB5613FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2