Extracted

• • Target
    62dd4c30a458b16576dfeb83d28287d13200016e70c6d247ad6c35eda38fd68c
  • Size 45KB
  • SHA256 62dd4c30a458b16576dfeb83d28287d13200016e70c6d247ad6c35eda38fd68c
  • MD5 7fc4d06b7e06c1a0eee86cab9c8b7529
  • SHA1 2452ad8578fed15ac8f33b4bcb10ee3777f51cee
  • SHA512 d40a0f2a875c682711de008ed07eb6bbbe562a0247f9c13e30d93d56d2cf2af790de57636d66b7d7197270198b13ae7ace4d1a065f224cabb267ff1c666a1e40
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9MCOtTMtPIszjb2gX3iAlgdI/icmBDZ8x:0u1YJTHcw2TRvs3bpXSAYd8x
  • TLSH
    T162231B003BE8812BF2BE4F78ACF26145867AF6673603D58D1CC441DB5613FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2