Extracted

• • Target
    611019d93eeca2b736c3f41ef33c2b2487007afab3589beb05e23cb29d938709
  • Size 45KB
  • SHA256 611019d93eeca2b736c3f41ef33c2b2487007afab3589beb05e23cb29d938709
  • MD5 33d9c0592f335afcdac1e8f297df3e48
  • SHA1 dff09ce63a1fa81a3cfaab93f9316dd8fb2d36d4
  • SHA512 a0d5bc5d8418ca5f0f49eb60cb5a4f366c57e15fd5e7489d7a5694e4f355b77e88b54bcdb26f103baf798d0afc53b84f05482d004e7ca91a857d84653fa58c3f
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1HFpPklON8APIDzjbugX3iNe7kXkc1fOHBDZcx:RuxkJTgip2O7kwN8lD3bRXSgWmhdcx
  • TLSH
    T1E5231A003BE9813BF2BE4F7899F26145467AF2637603D64A1CC451DB1723FC69A42AF9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2