Extracted

• • Target
    2501d0334482d76f2f203c5da97866b0570441e3f709fe18694dbc95463d0bc4
  • Size 45KB
  • SHA256 2501d0334482d76f2f203c5da97866b0570441e3f709fe18694dbc95463d0bc4
  • MD5 3de885bbe6a6424a8976c0a02da6364b
  • SHA1 993785c53f40ed1c25e222ee9038b2512da27a66
  • SHA512 d6ea93d609f28a48b8c5b075a67864bc68c2b4cf8f7851595361f57b068e0cb68459023a74c87697bbcfa51ad9347d1fe2c48ca2556dee659b251f0113ce09d3
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA+FpPklON8APIDzjbKgX3iVKZwiAhvD/BDZcx:UuKWgSJTwRf2u7kwN8lD3bdXSMZhAJde
  • TLSH
    T16F231A003BE8812BF2BE4F789CF26105467AF2677603D65E1CC452DB5623FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2