Extracted

• • Target
    92e383a3c315522756ba2b853bc8e60d3d9635e9d84a7bd220ba389ec2551c10
  • Size 45KB
  • SHA256 92e383a3c315522756ba2b853bc8e60d3d9635e9d84a7bd220ba389ec2551c10
  • MD5 aaf4b6fb5bd2a18f391ebaa5680636be
  • SHA1 20408bf33dc061b9e58b3cc998bb7046c79a1782
  • SHA512 5434079d93905b764f6836eea2d4234b68fa4f5c412ce108c71481e25b096842b45499914a51ba19e0a7f1e9f339a197b593c3e976b9192e1f08a204d6e29e1c
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFdm/9GgrOPIRzjb2gX3i/Ns8+PSCaD6zBDZEx:MuLAZTnbg2um1b3R3bpXSC8+YD6VdEx
  • TLSH
    T131232B003BEC822BF2BE4F78ADF26145467AF6637603D54A1CC4519B5B13BC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2