Extracted

• • Target
    b5b7ccf428391db918f3944a434d37f234dfa056729189b41f9d1a39842e6296
  • Size 45KB
  • SHA256 b5b7ccf428391db918f3944a434d37f234dfa056729189b41f9d1a39842e6296
  • MD5 968d6819f0044c26af8e97344837b2eb
  • SHA1 e415d279221cffa6e4f9eb462fa89ee642174c06
  • SHA512 3feb1c3602259a7817bc2a2d4d0261bea05e6569b40211a89e3f643c2c728c1baa820338de660549ebc0cbb36373c703558b8be29a370e635ce26c48f8fd136b
  • SSDEEP 768:wuSOpTPTCFcWUeXa6mo2qAUsD/pneqPIkzjbHgX3i3DqguF+CwoOJKFBDZAx:wuSOpTPOP2ksjJeTk3bAXSUF+COJSdAx
  • TLSH
    T15B232A003BE9823AF2BE4F78ADF25185867AF6633603D5491CC451DB1623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2