Extracted

• • Target
    768296a7eb3e3158fa4cc2da8f25438858f99eb7ee246dec583aed5257db0bf3
  • Size 45KB
  • SHA256 768296a7eb3e3158fa4cc2da8f25438858f99eb7ee246dec583aed5257db0bf3
  • MD5 944eb5ce0ce8d7b296cbe74e855e4c16
  • SHA1 48b373d0474bdd496621c4957051f16929dd9291
  • SHA512 575e9c601fd5cf7329c219393e4da075223f367484e71f050c0f8c9089f80e6304775db1d505ab677cb3750da08fe865ae508dcacf4311f51511c7f6648f1fcf
  • SSDEEP 768:5udApTNctooWUS7C+mo2qt5HO9YjoHPICYzjbGgX3iH4EeQ7h2b9uH/htkBDZ0x:5udApTNmU2Z6kgCY3bZXSHagkYZUd0x
  • TLSH
    T1CA231B003BE9C12BF2BE5F78A9F26145867AF2633603D54D1CC452D75623FC68A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2