Extracted

• • Target
    93f56f82b35ae11a0cfa40205cd9003cab8899603cb3246324a22041c2d0fbfe
  • Size 45KB
  • SHA256 93f56f82b35ae11a0cfa40205cd9003cab8899603cb3246324a22041c2d0fbfe
  • MD5 de74641e43d7c559440dfc30ec4f827a
  • SHA1 c125ed8b01708a1753f7df1e29554444b9a19bd0
  • SHA512 fa54a860d18e7c28b6a14f613a33702569b4ef5a84ad4e424e2ef016c7cda807187f5e78035683ea30de42f941510e190563c923224be90ccd833beab80ab413
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYh6R3aI6OPICzjbCg53i1XTF4d4j/uBDZ0x:8uuSpTgyf2J+qb3C3bl5S1jF4d4jYd0x
  • TLSH
    T1B5232B003BE8812BF2BE4F7899F26145467AF6673603E58E1CC4529B5713FC68642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2