Extracted

• • Target
    1d51591cb9a6c090d718c90cc22f8f1449c3d4ebec63d7c575aa482a7f366c95
  • Size 45KB
  • SHA256 1d51591cb9a6c090d718c90cc22f8f1449c3d4ebec63d7c575aa482a7f366c95
  • MD5 31b43ed6e8097aab92c99fae1b90b8ba
  • SHA1 4547701d0476198a2936c43ace4638d28f1af1f6
  • SHA512 a21528da3bcd61f01550ced3b293cd69393d0d92556ad75e0a3ef8d0fe24fa2a0af52c78572016dea25763386a2ed72659c24b98a1b28032cc5b550067423fd6
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF63HO4SNeOPI0Gzjb/gw3iYXbGoDSVLp5gh5nBDZEx:MuLAZTnbg2v+Je30G3bIwSQWVLpudEx
  • TLSH
    T1E0232A003BE8812BF2BF4FB8A8F26145467AF2677603D54E1CC451DB5B13BC696426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2