Extracted

• • Target
    911f130133264d3c7f91aaef97f7f287708012d6fab560a6081903804a15865e
  • Size 45KB
  • SHA256 911f130133264d3c7f91aaef97f7f287708012d6fab560a6081903804a15865e
  • MD5 9b5a32cad7fee039c31dfb6b918b389a
  • SHA1 be9ff6e408aa5cdd62a9ead352b5cb528a23b4f1
  • SHA512 7d84ad1f370ad85299932925a76dfbf20b5fabbb64360e142bb72f6f115a028ea917c3eeb297500af422cadfe5e8501603c2d7a3a95e9e3cccc6691b75afa35e
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVj0b3NEAteiZPISzjbzgE3iVBTvmY9U4BDZEx:MuBGJTPho2/3ehiWS3bsESVBbn9FdEx
  • TLSH
    T1F0232B0037E9C12BF2BE4F74A8F26145867BF6632603D5491CC451DB5A23FC6DA42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2