Extracted

• • Target
    05b7184e2e97dba9a7a7ce3663f9d7e8e7f77949101f415d7ea7996eedbcef91
  • Size 45KB
  • SHA256 05b7184e2e97dba9a7a7ce3663f9d7e8e7f77949101f415d7ea7996eedbcef91
  • MD5 679f1af75de26a36d3a344e8e5a681cb
  • SHA1 1e498319d22fffaed16d0d40ecdf282cea57717c
  • SHA512 45c50884b4f83a6151c5b3169ebe5f8bc8d5add2a325eaa6f2b234e4a1b01704120f3d9a4d1262b6cae7ecb308cac6fdff57171650e10c17f69ef9b25931a8e8
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV3xY6aZOOPIgzjbJgQ3iKWBv6u6YIfqnBDZUx:cu7e5TH2A2ku/O3g3bGQSxv+YIfydUx
  • TLSH
    T1C4232A003BE8812BF2BE4F789CF26245467AF6A73603D54E1CC452DB5613BC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2