Extracted

• • Target
    72d15a3f3b6f43b3204665122cf608304a76299a027c4bce321864d5677c60cb
  • Size 45KB
  • SHA256 72d15a3f3b6f43b3204665122cf608304a76299a027c4bce321864d5677c60cb
  • MD5 21f2c8e3ee91b254107baae77d71e30c
  • SHA1 c17ba067fe46dfb229cb6322ac9a119aba48b153
  • SHA512 c778d40c28fbf4307e02710fefea75f9d698576d07592ea7df2dd4444f8b1efeec412995c8826fc344497664a3774f119d8009920da09516d5fcb95e9a7b2c59
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1Gw0Q+KXPI/zjb/gX3iFALCGTIV2C3tLv/BDZUx:cu6YepTPso2X9/3bIXSFAuGTIV2e1JdW
  • TLSH
    T1EF232B003BE8813BF2BE4BB899F26145867AF5632503D64D2CC451DB5A23FC696426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2