Extracted

• • Target
    5597e066308e241b679d61586b6e9eb8e2fa2429123abda807dee2849bdb0667
  • Size 45KB
  • SHA256 5597e066308e241b679d61586b6e9eb8e2fa2429123abda807dee2849bdb0667
  • MD5 21a3fda9313c5796a28cc92d63d07a7a
  • SHA1 cfb997bd7da1c6c711372657b11d2f00f1875b9a
  • SHA512 81c3c8746e40829fec5e878372fccccbee453e0e13804e93f451fe88b6172865936eb5d883675d11f5f34c43ebf8ed48a9cfe1ed7052224a66447beb1c242ac6
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9tCSwTMSPI5qjbHgX3iIE1pfE+/HoBBBDZsx:EulCJTHl42agG5mbAXSX1psOIB/dsx
  • TLSH
    T14F232B0037E8C12BF2BE5B789CF26145867AF6773603D58A1CC4419B5623FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2