Extracted

• • Target
    6744792776077d3a930fe99528bee169899569ab4d015529438c33276ddc9342
  • Size 45KB
  • SHA256 6744792776077d3a930fe99528bee169899569ab4d015529438c33276ddc9342
  • MD5 eb5cfc9c607459ea18dd7c533e6aa245
  • SHA1 7a6b8371745d6716a5860ddd9f7f2962890bb7e8
  • SHA512 acd2540f1cf45aeb4503d30bc756f47722d28cb1ebc02db2154ea5c12cd499980e0f45785ab0a5b9f13e14bba15d97028bd98a4b173edd46f686c68bc0cde28b
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qw55dTQy06SOPIMFzjb3gXii7kN9vdTAi77y4cPx3B8:ku40ZTXEb2jmaS3MF3bQXL7kNjAi77yq
  • TLSH
    T126232A003BEC812BF2BE4F7899F26145867AF6632603D54E1CC4529B5613FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2