Extracted

• • Target
    683de088397ad84433b8829b397dce3fe150cb781e07123da783f765bd14792d
  • Size 45KB
  • SHA256 683de088397ad84433b8829b397dce3fe150cb781e07123da783f765bd14792d
  • MD5 c872f1dd512ac099f724c8a4d6508f18
  • SHA1 2f40a302cf2e4a0edf01ecc9eb5ef213cc9ba8f5
  • SHA512 5b92aee3d79b0cd3eefff8c27fac4618989fbc2a8e54139581109a22f84344e82e5ebf2167ee69756e08ca1f468be159aed8f82cebe06553013214511a8b8c57
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFMSAFcKoabbb4ZhM/RPIAEzjbrgX3i+qza+ypvF9Awm:MuLAZTnbg2vSAvQZh6OAE3bUXS+qypNO
  • TLSH
    T103231A003BE8812BF2BF4FB8ACF2614586BAF5672603D58A1C84519B5713FC6C6526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2