Extracted

• • Target
    5b548ebb1c093fa00fd60c67faf0c1589189df8d9e611f866d38963f879d13b2
  • Size 45KB
  • SHA256 5b548ebb1c093fa00fd60c67faf0c1589189df8d9e611f866d38963f879d13b2
  • MD5 3093701afd3c1d3057176e2f24e9ef14
  • SHA1 cf73c05068fdb2857afc1019d19275f4121dbe57
  • SHA512 6f57fddc207fa24098ec3cb6c2b6b505a9560d39ccfbda2239f83451ac5fea5a3631ff8abf7489295717bd71a2629702cb7b5ef0a6992f6164b30db8ac5c393a
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE0yFjrdjYkk8PIuZjbwgX3iI1FMhyysli1GeBDg:cuR0JTPjY2SLBXQBuZb3XSSFMhmi1LdW
  • TLSH
    T19A231A0037E9812BF2BE4F7869F26245867AF6633603D64A1CC441DB5713FC69A436FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2