Extracted

• • Target
    d1fb5a351569f628e989ec3ab6f090fe581cd2a3dca7c04d5895a19e202059a0
  • Size 45KB
  • SHA256 d1fb5a351569f628e989ec3ab6f090fe581cd2a3dca7c04d5895a19e202059a0
  • MD5 24c06ba0e7467d3751a87b75e74ecce4
  • SHA1 f3efabfae1bcd1bd7e7479790ab15a8f4b93b013
  • SHA512 8b179364e75ca52db17d5eaf596a814c43f88eed70cef6884f2d279f6fac38bc818a30ed71a768bec4e053f72f68629f8ec42249834a7fcca7d932d434bafa69
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q95oRQKIJOPIhzjb/gq3iuPZzOKuAy2nyxthBDZsx:EulCJTHl42mYxg3h3bIqSuPduAy0Uhdu
  • TLSH
    T1E323290037E8C12BF2BE4F78A8F26145867EE5633A03D58A1CC451DB5613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2