Extracted

• • Target
    88ff8e1edfe64a7734c727b70da5c076ee022d3f8e3d6ac07454b5c0452997d8
  • Size 45KB
  • SHA256 88ff8e1edfe64a7734c727b70da5c076ee022d3f8e3d6ac07454b5c0452997d8
  • MD5 9c40bd41efcd9e9d85868d2830c85ae6
  • SHA1 575ef89d32928490de45f55c21458fca99ce4c3e
  • SHA512 c8953a075e041a3d5ce247423dedc90ea7504a41738d49fc576ef7f88343efd34a7475d1efa46ab3d958ce84c1877d4cebfae36094a02b9ba4a9577be8b62575
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwvBl3040WMOPI0hzjbNgXAi0pdmULEBDZMx:ku40ZTXEb2FeUM30h3baX90pJLydMx
  • TLSH
    T1DC231A003BE8C12BF2BE4F7899F26145867AF2637603D54A1CC452DB5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2