Extracted

• • Target
    757ba52f4430041409ed35f0fc7acf4fc3ee0b8b282129507fe7f60fefb123aa
  • Size 45KB
  • SHA256 757ba52f4430041409ed35f0fc7acf4fc3ee0b8b282129507fe7f60fefb123aa
  • MD5 4942d5792063f53990c39ef549cb1a33
  • SHA1 bfd45ae623d35e76f5be0bbc375041311112cff0
  • SHA512 625144f4e9c22bd034c2f8788285f7e5eadf059dde04e0c381f0e0bd518c9dc9f0b467b999a7af59cf5f0d2e8c61722ab7e1185ed616d416a0b09ea108348f73
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qA8H0CnrQRPnH8PIEJjbYgX3ieoPAHBDZMx:kuSOpTPOP2MfnkdBEpbPXSzPAhdMx
  • TLSH
    T1AC232B003BE9812BF5BE4F74A9F26141867AF6632A03D54E1C8441DB5723FC58A53AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2