Extracted

• • Target
    c124da9d5bdcb257ecd21423b4aadf022581718dfe2c7969e7e7a57bc2a20684
  • Size 45KB
  • SHA256 c124da9d5bdcb257ecd21423b4aadf022581718dfe2c7969e7e7a57bc2a20684
  • MD5 d823d557c0a10fce896e86b2961fbc80
  • SHA1 acf33efe9f37a948d5adc7e6b4f9d001532e5955
  • SHA512 f13a04047235005bf87f09227fb3dec13976160fd0d0740bcac0f84061faa1b1d633ad39858ad44c8bffbac75fb81e6a1c9ecd313a03dc0dc57fbe9e34f981cc
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF8mJ5G6ROPINzjbQgX3i8pskd4UI7f8BDZUx:cu7e5TH2A2nmD33N3bXXSw3bIOdUx
  • TLSH
    T130232B003BE8812BF2BE4F78ADF26145897AF6B32603D54A1CC451DB5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2