Extracted

• • Target
    be85b9ccc4f951909e04d4df99069cdd40e9eb96d54a1dd5c9ad9a2318be293a
  • Size 45KB
  • SHA256 be85b9ccc4f951909e04d4df99069cdd40e9eb96d54a1dd5c9ad9a2318be293a
  • MD5 e63a18a59698a7e5f64d320ce637936a
  • SHA1 8bf26ed87346a321c72af7d8a9ee82e62eb26abc
  • SHA512 1f5aff50290dab72ba663dc39263a4f55db46ce3347b518f06a593699668f61de1725df3a1ffc0af1be98be783644f84a86a5589543a04d5647722224567a0f2
  • SSDEEP 768:cuq04JTLcsP8EWUmOTymo2qAZ8V1QpfEcPIYzjbBgX3ihVtdYqtEYexIfvtBDZUx:cuqNJTLr62p8ViBEhY3buXShdWpxIXj0
  • TLSH
    T1AF233B003BE9C227F2BE5FB899F26145867AF6632603D54A1CC451CB5713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2