Extracted

• • Target
    e832649dcc328ba6bc9bef79fd102fe8945fb14a13e6f154242457ee2ab36d92
  • Size 45KB
  • SHA256 e832649dcc328ba6bc9bef79fd102fe8945fb14a13e6f154242457ee2ab36d92
  • MD5 d7fcf4e5b1e82162784fe123f7eeab46
  • SHA1 7751e8606bc371222e1f48eb4506b33549f1098e
  • SHA512 20be75cd1b73385162b932b173e7259a79476e77bd0e391596d4c9f7ae17d4aaaf4ae9e1f84d7a48b2bb7420aca0c8eedb848a600b438ff239bdc8df1c0fa466
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1a/qpG3jHuPIgzjbIgXlieacgjdEJ1LuDIBDZcx:RuxkJTgip2nIM3g3bfX0ZcGyFdcx
  • TLSH
    T1DA232B003BE9823BF2BE4FB499F26145467AF2637603D6891CC441DB5623FC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2