Extracted

• • Target
    674d9c07de8fe3aa6ac4c3924986fe4115a8fe5bb9596c7f2fdf3c10f27abb73
  • Size 45KB
  • SHA256 674d9c07de8fe3aa6ac4c3924986fe4115a8fe5bb9596c7f2fdf3c10f27abb73
  • MD5 5cd337c72aea923fe4bd5fe8a61f97be
  • SHA1 3fc8258feede9967ddc6fbb753657874038148c8
  • SHA512 0c1364ed03e4a7b5956399f38ac3604aff91b9477e680a870dd106791d549cea73acfb31ddca914b8a204752db2360c522f49f178cedc34ba2d160bec3b2c078
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrzjHy/aKPIbQjbNXgX3iAaGvn9fmnLKevovBDZ0x:5uSy6pTpoo2onhbYbuXSWvn9ALK4oZd2
  • TLSH
    T102232B003BE9C12BF2BE5B789DF26105467EB5632603D64D1CC411DB5723BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2