Extracted

• • Target
    7456cb74c843e0fbd8b20a87133f097ac91c687f415ee8e172417420f87e450d
  • Size 45KB
  • SHA256 7456cb74c843e0fbd8b20a87133f097ac91c687f415ee8e172417420f87e450d
  • MD5 8740bdb0007a4298b71643d2bb0e600f
  • SHA1 5864e6e332c6858426f6ca8f769ecb551d8ea18a
  • SHA512 23832cba8ea057e592a39e69ade389cfe1390f0cb245ec62000757cbddcfbc2edb3aee0eacb634404ee1ee86144b2d9662df44e22619dd81da4e4830e5cbbaf4
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlN3xY6AZOOPILzjbQgv3im2+swGTMC23BDZMx:wuDWZTpMZSB2MulO3L3bXvSZ9YCWdMx
  • TLSH
    T122232A003BE8C22BF2BE4FB899F26145867AF6B36603D6491CC451D74613FC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2