Extracted

• • Target
    81ae07f2ba1bff33ab3a33a4b33af1be5f8f5172b76001b8bd8a7ea0a0548983
  • Size 45KB
  • SHA256 81ae07f2ba1bff33ab3a33a4b33af1be5f8f5172b76001b8bd8a7ea0a0548983
  • MD5 3fe957f923fb0b09dd8ce4b8fca909ce
  • SHA1 7fb5b000e2634727be9d045f3b8983b31f26fc60
  • SHA512 2787185dd8a6c8c5024191aeeb5d7a8415b37c08760ce0e96209ebfcad3096b322aff5d6b6a0d41825abe8f8bae24794978a06e40b399c7ff90cfbf5ea62a175
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qViqyx0OFUwdrxIkDPIezjbwgX3iVhpZmbBDZEx:MuBGJTPho2fqKTNMe3b3XSLpZQdEx
  • TLSH
    T1FF231A003BE9812BF2BE4F7869F26145867AF6633603D54A1CC451DB5B13FC69A02AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2