Extracted

• • Target
    732e9fa73f657a4e5c54c57762da6fd907b1da767da1c5bae16b0a69d775b816
  • Size 45KB
  • SHA256 732e9fa73f657a4e5c54c57762da6fd907b1da767da1c5bae16b0a69d775b816
  • MD5 af5e4875c7da18eddf83d97d4cf76f51
  • SHA1 b0995b7cfe8ba1f8fa58b6f190039ead07880ded
  • SHA512 90053b69df357703b52e176bc6568bfd7313bbeb8b5cf0187d986a9cb6261eebb77fb74e4d0a731bd8b7f5433c7abc27f53d5d082a0968e5dabedadc1f3fa9bc
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAOGsGx8OHuPI2zjbdg83iQYDc477KJN9yBDZcx:UuKWgSJTwRf2eez323bK8Sy48N9Mdcx
  • TLSH
    T150232A103BE9C22BF2BE4F7898F26145467AF6636603D54D2C8441DB5723FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2