Extracted

• • Target
    74dfe932459a75de07895b69f4e1d470497e88cf449b3a18f0d1cf637dee542d
  • Size 45KB
  • SHA256 74dfe932459a75de07895b69f4e1d470497e88cf449b3a18f0d1cf637dee542d
  • MD5 52e93b7dadaf06ba2b82f7079f3e12f3
  • SHA1 91b857609ee0934dee7e2acab3f0881fa9c1d218
  • SHA512 f7749e4613387d611c679092e2f958b8afa4cff596d2e3a484a9d2353c5d62d5a01e3146c76870e29059daf29734666f19832bea3dd857fad69d2eb84505ba8f
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qFA7lt440WMOPI0szjb5gXMiJwW6r8A+ekL9WBDZEx:MuLAZTnbg2VgUM30s3bWXpJwW6rp+ekZ
  • TLSH
    T1D92319003BE8812BF2BE4F789CF26145867EF6636603E54E1CC4519B5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2