Extracted

• • Target
    10245b02a789ebc9b36b16f028d0bc8ac67c49492f2c455092b5771ab730b279
  • Size 45KB
  • SHA256 10245b02a789ebc9b36b16f028d0bc8ac67c49492f2c455092b5771ab730b279
  • MD5 de2e690d8b0a896367d9edefdd2f01d7
  • SHA1 1753d7c2cecaad66efbd65c326290236bca50940
  • SHA512 a143f0f16a6828ff7d6017564ac5c9464771cf40d89443751b38ede1fe1f16555fa200d6a19d3864af914ffe5731c31cd4887b1bff1080e84b04e4a1198dff5f
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFvZTohEaSPIrzjbYgX3iHHVVVkjTlm+9BDZEx:MuLAZTnbg2O4Ea7r3bPXSnr0VdEx
  • TLSH
    T172232B003BE8812BF2BE4F78ACF26145467AF1A36603D64D2CC451DB5613FC6DA526FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2