Extracted

• • Target
    672808b6c20e097cc0e35eaf470a23c37843e12ab206bd0ce66360b912b28548
  • Size 45KB
  • SHA256 672808b6c20e097cc0e35eaf470a23c37843e12ab206bd0ce66360b912b28548
  • MD5 b9b7439c860da39b2d5bcedf307473e6
  • SHA1 e9753d8d7bbea97d37638248ae25b5cf9f04e634
  • SHA512 d38c85ffdfd25dfc24b4a0f2c9af8a5dfc8a6653f29c366faa75421f06b9d0acb0afccb6ceaf510361f442d78424d671de410d2d461b0d44ccceae6487b0c4db
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVtBz3QKx7PIUxjbIgX3ihq2E6ZJsULvb5agVBDZkx:suJdpTPdI2IV0UhbfXSBZjLvMg7dkx
  • TLSH
    T1D42309003BE8822BF2BE4F78A8F26145457BF5636603D6892CC451DB5613FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2