Extracted

• • Target
    6512280056842b6e26f927eb964f1f6ea2f707a38a405932f88d2d94a3a34025
  • Size 45KB
  • SHA256 6512280056842b6e26f927eb964f1f6ea2f707a38a405932f88d2d94a3a34025
  • MD5 adbc6ac9091fde9496669bbe4e39fa55
  • SHA1 4881bea48d1327b03bb8874e0672ca056e1d73a8
  • SHA512 9f31dca7ca93854e22d957f427b272a64d26aa5065a2f4c01cf54a50ae479579584d0eb6d164eb69d62f2e0332023ea6c73750dc6707f93504c4c8ddeb1c925d
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdj3kk8PIhljbQgX3izgSyIdIxcyWW2pQ2:cuR0JTPjY2SLBXDBhtbXXSzkIdIuWpdW
  • TLSH
    T1AB231B003BE9812BF2BF4F7859F26245467AF5732603D94A1CC451DB5723FC68A43AEA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2