Extracted

• • Target
    c255d6509aecce06af9b66fdc426314e1740810d3cae1a6c31669bbe77160e6b
  • Size 45KB
  • SHA256 c255d6509aecce06af9b66fdc426314e1740810d3cae1a6c31669bbe77160e6b
  • MD5 a43608462ad523da93cc98a6a065bb4b
  • SHA1 d346afb402b432bd39a0e97de12084789f516c77
  • SHA512 992c9d7d0d01da416e77ae3bdd3b26f32324d3ac2c5729d497bf459b6d9927ab4719522ee179f401a6986f8946318dd1795d2cb6d44d7fbe31d359b2b8cfc620
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9sZo3TMtPIQgjbHgX3iKx2Wz+WecGiBDZ8x:0u1YJTHcw2dU3QIbAXSA1ecRd8x
  • TLSH
    T10F231C003BE8812BF2BE4F789DF26145867AF6676603D54E2CC441DB5623FC58642AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2