Extracted

• • Target
    d1d17c7bb0c99e96b44b66cc5ac743c5fbb64012dfc0b0502c46e2db6a3db574
  • Size 45KB
  • SHA256 d1d17c7bb0c99e96b44b66cc5ac743c5fbb64012dfc0b0502c46e2db6a3db574
  • MD5 b6b77cc251c02da5c092555b3e131085
  • SHA1 1c71866a3136a7f057d877953fb2fd9e97aa83f0
  • SHA512 8e4d555c76c1b90dd79eb28e9856d4c014ba33f99349e27fa50138f551d653bf77e43c3e9f1b182345d0f835a219715e28f8b984b3d1f5d3a694dd33cc1d9afc
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCMhdjCvS8PIjajbVgX3iBuv+Idd7t+/8WWBE:MuBGJTPho2Q/CChBj2byXSovr7tGYdEx
  • TLSH
    T1F9231B003BE9C12BF2BE4F7898F26145867AF6732603D54A1CC451DB5723FC68A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2