Extracted

• • Target
    91a2cdd63744801aab7c5655eeab13cd12a62b2c753702710d70dfaef479c3ac
  • Size 45KB
  • SHA256 91a2cdd63744801aab7c5655eeab13cd12a62b2c753702710d70dfaef479c3ac
  • MD5 84190def9fd4d520121311b89983012f
  • SHA1 efa44350d348f10bb3442d308d66cf36a07763d1
  • SHA512 4a7e72114a931bbb378063213f4ca736ac88e80c63d619ad2d9c31af265d0147d7eb98e2144d07ed0d034211d7fc0fc5be66d01dd2e9a3a41eacb445674f3b8d
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9L9YSkqXzNOPISzjbEgj3iR7p9OKG0NhBDZsx:EufspTf2g2maVq3S3bLjS9HbG+fdsx
  • TLSH
    T1E3233A003BE9C12BF2BE5FB8A8F26145467AF5633603D64A1CC451D75723BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2