Extracted

• • Target
    b197ed77e8321168d88870f863fa671257ec411ee9edc76fc91a21671f74cfb4
  • Size 45KB
  • SHA256 b197ed77e8321168d88870f863fa671257ec411ee9edc76fc91a21671f74cfb4
  • MD5 ddc7b5b14b93f350f73d5259364d4d6a
  • SHA1 04b68e1cd20b6d62cc4e39b7bcc2983b58d614db
  • SHA512 317c146f6e749dfcb30cfff830e7a2780ac5bddf2e21bcac1c956e77963331ea1102a612e2734226ce992e3eed5c4c21c0a0a0bbf214d3fff72fcb8fa1755393
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/NYssPJZOPIczzjbEgX1igMvcFBqDiCOdeBDZsx:EulCJTHl42eHIf3cz3bLXkgMQqV5dsx
  • TLSH
    T1C9231B003BE9C22BF2BE4B74A8F25145867EF5637603E68A1CC451DB5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2