Extracted

• • Target
    0b1c611585dbe1475f053ade6a4ee3733418fc9fdd3b046e8eb1fc12c1ffbc3c
  • Size 45KB
  • SHA256 0b1c611585dbe1475f053ade6a4ee3733418fc9fdd3b046e8eb1fc12c1ffbc3c
  • MD5 7bd76085c26fc90b25f9acaf2f5b74f1
  • SHA1 65b1f0f23abc3a47dc6b3cffed672bbf18be2f36
  • SHA512 8702f2873d7e2a8d210fd6f4c128f16260078ed83aea33c822b0648f737be4f80d4a58f68815935c33bd5a2e274dfc22a4847cdeb1bcc7225d9a80851ad8844f
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1TgzZUpx7PI8sjbfgX3ipdPV820OrV3KVoYBDZUx:cu6YepTPso2Con8cboXSpdO2lB6VoedW
  • TLSH
    T15E230A003BE88127F2BE5FB89CF26145867AF5633603D64A2CC451D75723FC69A426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2