Extracted

• • Target
    88f9aede8732559d270589b3da069c7d111b608adcc1bd6225f0e6d90ff87fd7
  • Size 45KB
  • SHA256 88f9aede8732559d270589b3da069c7d111b608adcc1bd6225f0e6d90ff87fd7
  • MD5 5d18cad9d4639fc8d311b66a83757c01
  • SHA1 aca14e2bf70343f378cbf222207eb7c8f9029eca
  • SHA512 f8c58c0ca77ce16d544d1c58384e7a9f774b72b454035b4d4412e4b611a70991e0a1759969a2b29ef541f9a08a49c62a964827cf4e98daa4b32c8bdbe8d4698f
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q16T2Qpm7PIKXjbWgX3i3t8eQBDZcx:RuxkJTgip2meKzbJXS3tCdcx
  • TLSH
    T1EF232B103BE98137F2BE4FB8A8F26145467AF6632603D64D1CC451DB5723BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2