Extracted

• • Target
    027b1d9bb984ea8042c0a0ab0387093253b49b0021885047d13bebbfd986672f
  • Size 45KB
  • SHA256 027b1d9bb984ea8042c0a0ab0387093253b49b0021885047d13bebbfd986672f
  • MD5 834c32167a73f93150446f05f250addb
  • SHA1 2839c75a3f29935ed4bf0f7c408bc0deab658f8a
  • SHA512 688aa316ec0a050ea123a501bd6add3690922d6691460a26052b5a820f9b3e7709d083e9634c1d2607a098a09adba328770924bc6e6d5d441177147620ee2c83
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1IxJaxMwHuPIvzjbxgw3i+9QTFtPNC8dH8BDZUx:cu6YepTPso2BeN3v3b+wS+9SP1CiHadW
  • TLSH
    T164231A003BE8822BF2BF4FB898F26145467AF6636603D54D2CC451DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2