Extracted

• • Target
    c80c6797a6027cade871b5485286007db432759b3c97b18f4eb411f1d579a744
  • Size 45KB
  • SHA256 c80c6797a6027cade871b5485286007db432759b3c97b18f4eb411f1d579a744
  • MD5 fd3c413a59109e791dd267653bd7417c
  • SHA1 a513d9e0e22246f3c9402bb18cd65b9e1f4d58f0
  • SHA512 784a5320e2fd45af5497141b718231e625a163e9b34ee6fcdf863636a3913175d7c2bbed6c34158ffe2a0a5be0cc521ea7729b3f38dccab4cf3acd380a4f86e0
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAW0ewtDc30oiZPI/zjbAgX3iehTnuJ6aeBDZMx:kuSOpTPOP24wR2iW/3bnXSehuJYdMx
  • TLSH
    T1E4232A003BE8812BF2BE4F7859F26145867AF6632603D5891CC441DB5723FC69A53AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2