Extracted

• • Target
    755f55ffa1c43a0bab692cd718eec7cc05f3216153958fb4c7e20f180ba74ea1
  • Size 45KB
  • SHA256 755f55ffa1c43a0bab692cd718eec7cc05f3216153958fb4c7e20f180ba74ea1
  • MD5 cd82391ebd713479bb1eae57a21d3830
  • SHA1 d525f21ac8fa0fc7c82513f08b2594fdc6174c42
  • SHA512 bdce95e31b07de14880c7a65a55820dc8f7bb4e3575f0de9b5eb2353bcabdc1e39176892244cfd504699bcf236b7005d776fc1557e0691d0408cd5dd3ed11d93
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9wO5QSCBzHSNjPI7zjbtgX3iusLyd1BUFBkBDZsx:EufspTf2g25O59ESK73b6XSb+OSdsx
  • TLSH
    T1C0233A0037E8C12BF2BE9F74A9F26145467AF6632603E9492CC451DB4613FC6DA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2