Extracted

• • Target
    5ad537423ef7d3104070e01c504b9c94f5ad58ad129df1a348ef034b8173645c
  • Size 45KB
  • SHA256 5ad537423ef7d3104070e01c504b9c94f5ad58ad129df1a348ef034b8173645c
  • MD5 22be1d74f2342fe7c256bc0775027003
  • SHA1 a7d69f9d9f35835ac1a6e5785bb047c9b864bcd3
  • SHA512 99c81e6cf3fab10e781f9a867a79039e494f7d1e03d878c3165601e49f6cb6fa405d597115a405712f8a75d568b57c0a44c8df2c191533e671dc6488db0dfc94
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjAO54qCBrHqNjPICzjbggX3iWDQchL/houiVBDZ8x:0u2vpTDe+2XO5d8qKC3bHXSrchLc7d8x
  • TLSH
    T1ED2319003BE8812BF1BE4F74A8F26145467AF6637603D54E2CC452DB5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2