Extracted

• • Target
    b606b618f71f38876afac99549af9c3b561cbbea6d143fbb860f459099da5a3a
  • Size 45KB
  • SHA256 b606b618f71f38876afac99549af9c3b561cbbea6d143fbb860f459099da5a3a
  • MD5 8844f634260abe893d77db63986a2dca
  • SHA1 382032cb8b14a859e66983b88fb89e30adc90952
  • SHA512 ee668496d4ae5335cd8c2103c8ffe7cbd16afc1e456669b4b4b96d13619555435a5a82b3041d533581436f89139235f8939711c563a31a63f645c24d9dd77cb4
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYlCfwTMjPIqrjb0gX3iF98wtHBvj15BDZ0x:8uuSpTgyf2d91q/bbXSZ5j1nd0x
  • TLSH
    T196231A003BE8812BF2BE4B78A9F26145867AF2773603D54E2CC4519B5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2