Extracted

• • Target
    725da5a4426d368287f3855a2234bc6a2f6a67e6d0a5d3e6b331b168ebe2b366
  • Size 45KB
  • SHA256 725da5a4426d368287f3855a2234bc6a2f6a67e6d0a5d3e6b331b168ebe2b366
  • MD5 bbd1e35d55cf7f139f80873f8afee94a
  • SHA1 c25713a581ac2334480ff2a77cf1bb8dbf8c9286
  • SHA512 70b8bd47096bd24a1f48cdfae92c5d5733f4a7d5b768871561b2c6690870280018d1a6e477b9d5561339ceeb2a745a049f297cc5225bc0077bf33090d3301420
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q97S7synzuOPIzzjbKgXRiBOeskmhOBBDZsx:EufspTf2g22SYh3z3bdXABMkmmdsx
  • TLSH
    T14B2329003BE9812BF2BE5F78ADF26145467AE5633603D64A1CC451DB4713FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2