Extracted

• • Target
    57447eff8922f2326223041f9fc7e18ebe5508db9603b9164dad51fb1acdd76b
  • Size 45KB
  • SHA256 57447eff8922f2326223041f9fc7e18ebe5508db9603b9164dad51fb1acdd76b
  • MD5 0dcf4fdb17864e021c1428206f26bbd0
  • SHA1 48fc0cab71523b8f6ca4cf2751b39f58573ab9d0
  • SHA512 f9c358a14873d823dd6b8887ebf79f95a03f814938af09d86793cf7dd9a403bd711c91fab7e84593268d4fe1e47f27933de533c16c1f0fd9a17eedbb6b222b3e
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFEfBohEa+PIvPjb4gX3ivyVzUZOWA7sY/gBDZEx:MuLAZTnbg2Z4EaHv7bvXSvSFtsYedEx
  • TLSH
    T1E5232B003BE8812BF1BE4F78A9F26145867EF6636603D54E1CC441DB5A13FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2