Extracted

• • Target
    5823c1e06c783f0f923896dbf487647c2f26f938398f8cf418e6e4144b58f136
  • Size 45KB
  • SHA256 5823c1e06c783f0f923896dbf487647c2f26f938398f8cf418e6e4144b58f136
  • MD5 77888cd0869b879492b82da4c06a3b6a
  • SHA1 6d335df71c89fb509efac442cf964abe088d9769
  • SHA512 810706c4028d6cf996d47d4718804f6972a2893a044fe9dffdb654e987f74923eabde2d040fbce02632828335b1d7527c6ff069236e539efe9924eac8d10e5d3
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVWb3/GYjHuPInzjbOgXJis4GiAhdu0c9bikBDZkx:suJdpTPdI27L/3n3bxX4s3Fhc9bZdkx
  • TLSH
    T152232B003BE9812BF2BE4FB4A9F26105857AF6637603D64E1CC451DB5723FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2