Extracted

• • Target
    91cddbc9ec04d5eede08e7b275d823c3dce5d71e4036d7af0fbf118031a05c3e
  • Size 45KB
  • SHA256 91cddbc9ec04d5eede08e7b275d823c3dce5d71e4036d7af0fbf118031a05c3e
  • MD5 6d1356bce168d229eab0b072f722f6ec
  • SHA1 c8392a0e13eeaac94afbccd865b51d0292f69a6c
  • SHA512 c711b8bc4c5d18f821393d523685b5268fe488f97ad070a6b016e75b1fc1754d3928adcdbf541c179cbdb2c9f3fd10a4a477160bdd606caa5f90c1c6bde6d3e2
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVyon6lq3API1zjbmgX3kPva8MgH9BDZkx:suJdpTPdI2TlE3l13b5X0Pva8Mgzdkx
  • TLSH
    T13223190037E8813BF2BE4F7499F26245467AF6736603D68A1CC451DB5623BC68A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2