Extracted

• • Target
    17a4622ea6664e4a71ecea083d683be8275b88283501e5bb15b9c967c5580b25
  • Size 45KB
  • SHA256 17a4622ea6664e4a71ecea083d683be8275b88283501e5bb15b9c967c5580b25
  • MD5 dedad17fa4bd4ac0738c552471ec306d
  • SHA1 a66fdec5521eeaf1762ec11b241483f1bb7d766f
  • SHA512 883c4a6763754cd61eed2ea22c7cc54a30f11ee2043e187715b7d5dbe1cb06ef1520441b38f4ad928dc3289f1c6d09e1d433bdb2ce3dd197d5916cf9dfbe050f
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVtmaPAlm3API/zjbwgX3iSJAuelvPbzXz7bBDZkx:suJdpTPdI2ofA43l/3b3XSmiPXzRdkx
  • TLSH
    T16A233A003BE8C12BF2BE4F78A9F26145467AF6637603D64E1CC451DB4623BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2