Extracted

• • Target
    ee6317536383a5febb34c3db8e62e4b68616e3feee28f1043074b49403f67cc1
  • Size 45KB
  • SHA256 ee6317536383a5febb34c3db8e62e4b68616e3feee28f1043074b49403f67cc1
  • MD5 3c8506032599f577532e5a3550bb38d9
  • SHA1 8b4954d213c964db8ba7f68649b059f568195b06
  • SHA512 3f420534f14046fb83f0322f7c6ae61742232c56e07e07bb221918adf2e67b23541f3c8d27ab813b75356affc2c5b0f9a902c71897af681b84d0f3f4a9f43832
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4IcQSCBznqNLPI7zjbOgX3ijK/TzdLAbo69aUBDZ2:8uUIpT4vAj28c9UqC73bxXSwTzJ/+aiU
  • TLSH
    T1042329003BE8812BF2BE4F78A9F25145867AF2637603E5492CC452DB5713FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2