Extracted

• • Target
    77a3171a21fd767d5db215cbe3816e37e5145cb396ff4a8cea3ccabc4b779b20
  • Size 45KB
  • SHA256 77a3171a21fd767d5db215cbe3816e37e5145cb396ff4a8cea3ccabc4b779b20
  • MD5 e7b1c464f884123a8b54dd69cddbeab1
  • SHA1 ebd3409dce0497925e8d16cfed8a9a50603c44f5
  • SHA512 847de67b2046be102c9871f7a780b8dbaf174cd779924067b689cb3483ff2ce7330559f4221fd7d4ca65fdbd421399fc7decd42a674734101488b5a615e1ef18
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFkhk6K7OOPIzzjbngw3i7F2FLqEKfM7mBDZEx:MuLAZTnbg216VO3z3bgwSJ25qpMkdEx
  • TLSH
    T15C233A003BE8812BF2BE5F7899F26145467AF6B33603D6491CC4519B4B13FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2