Extracted

• • Target
    18e52cb49adf69eea97b2d7109481e23f6d56f3d6a69c51cfd3c8f33f66a591e
  • Size 45KB
  • SHA256 18e52cb49adf69eea97b2d7109481e23f6d56f3d6a69c51cfd3c8f33f66a591e
  • MD5 a4de59ebc41d57b23da91fe5b34164fe
  • SHA1 02e8e73db59a2933ea3e84630e29496c144c66fb
  • SHA512 614a4e6c452610ca435dd765d78b2d7af0767843dc76413ab968806834273971e0896d56b2e051712eebe87042e1a87dabbbdae9ef1d33fc95e0f12c47710d87
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFkhk6c7OOPInzjb5gy3ijFGeDQlBdH2CB/BDZEx:MuLAZTnbg216TO3n3bWySjdMZWyJdEx
  • TLSH
    T13B231B003BE8812BF2BE4F78A8F26145467AF6773603D5491CC4529B4713FC69A526EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2