Extracted

• • Target
    d600f2c4461e56566873a37732d1a8f25be003cf33a6b2c2424a895901660b9f
  • Size 45KB
  • SHA256 d600f2c4461e56566873a37732d1a8f25be003cf33a6b2c2424a895901660b9f
  • MD5 3573c5395a95b73b2b1af3f2435655f6
  • SHA1 240db753e53ce96dfeaebb0da23bfb4ac73acb58
  • SHA512 1e66b4297b6d9eebf53b7ba63fd401b0128900e33b184f20901deb91672fc2d1aec355ec559ce4ff90801ebb2009bcb16b73cc9e6029627c6b9ba29d8750d39f
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE02FjMdjYkkmPI0zjbigX3ieH0qpVbSEMrHBDZO:kuSOpTPOP2KL9wQP03bFXSVqpRSEWhdO
  • TLSH
    T187232A0037E9812BF6BE4F7869F26245867BF5732603D68D1C8411DB5723BC68A436FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2