Extracted

• • Target
    78854e1f05d4500b2e728360918003b55239adab7feff7b133c59d527980d2b2
  • Size 45KB
  • SHA256 78854e1f05d4500b2e728360918003b55239adab7feff7b133c59d527980d2b2
  • MD5 37e32086450391d8a9d14039ba91bbc8
  • SHA1 21949b43779cf1c718b064e1aa4045f3b2c3c86c
  • SHA512 3e337e1e37c5f4aab2e9f63c43bd5b3c5480d84a2f12ad0214b6aa03ade5c1bc123e5e6f8a5f399a9aedbfc31480b0c43c27ddb2066327be404d2f15a7811187
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Jw0QUKXPIRzjbcgX3i6uctYCZzgHUk4xZJ/XStn:cu6YepTPso22fR3bzXS6ucCUg0kqJ/XG
  • TLSH
    T192231A003BE8813BF2BE4FB898F26145867AF5633603D6496CC451DB5623BC6CA526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2