Extracted

• • Target
    779b1f3531f67bd2e426defc98fdd2c6ae17ac61380f87bbacd39fc02d760137
  • Size 45KB
  • SHA256 779b1f3531f67bd2e426defc98fdd2c6ae17ac61380f87bbacd39fc02d760137
  • MD5 97d8077a8a5298169fa7558e24c9fc0a
  • SHA1 d8c477b8fc4ec7923b8898b56a95a93deaf1b721
  • SHA512 5749fea62716b018788d7fcefb30b914251fcc6bc11acbdf4b9ed1d5d9a97af167ce922a0170a5b26324d7622a01b3ad4d81fbe0c9f369baa51003885d52b94c
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9sZoyTM4PIXajbpgX3idgIOjCqm6BDZ8x:0u1YJTHcw2dh0X2bmXSuIOjPd8x
  • TLSH
    T1B3232C003BE8812BF2BE5F7898F25245867AF5673603D5492CC441DB5723FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2