Extracted

• • Target
    ead95a1ff257794bc88a038f52be9d571d08c9ebdafe6065c2bb6b81b868709d
  • Size 45KB
  • SHA256 ead95a1ff257794bc88a038f52be9d571d08c9ebdafe6065c2bb6b81b868709d
  • MD5 64117851f878995cfbb27ef045a4d30b
  • SHA1 735c0c39c024451d8b1139697048317dc5214962
  • SHA512 735a4420ad612b8c85e280f8450321b44d8c87caa8edcc819d02d6b29f972147185bbd1a9007707d59443a5f95426e5b802fc4efcbaea9cb721e4ca39e9a5ce2
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1mGsGx8OHuPI2zjbdgU3iw5KMQ9AIdFUxSNDPBDg:cu6YepTPso2rez323bKUSw5K22ND5dUx
  • TLSH
    T19D232A003BE9812BF2BE5F7498F26145867AF2633603E6492CC451DB5623FC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2