Extracted

• • Target
    958d00d3ae6fd3bc90f4085857888f8b02a3ba21d53020544164570a973e800c
  • Size 45KB
  • SHA256 958d00d3ae6fd3bc90f4085857888f8b02a3ba21d53020544164570a973e800c
  • MD5 1e12580da3687db99b8291b50ac3d4b5
  • SHA1 80439905f42e9446e16e8c1de09e5d0cd0513059
  • SHA512 91a87966d7decec281a2aa2454b30b3f38b885d7473ccc74229a2fef7102c8a5d6c7dd101671838a9d00821b9dc8ce66c24b72d3b4c13ec8b80e85ac7c1935ad
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwqlsHoPEaMPIG9jbugX3iHuxlJaPeztWItdBDZMx:ku40ZTXEb2euuEaxGVbRXSAlJaPS99dO
  • TLSH
    T107232A003BE9822BF2BE4F7898F26145867AF6B37603D5491CC441DB4713FC69A526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2