Extracted

• • Target
    57152da75997444da1fd22951d7ab590a7f983471e836380146be3676144d53c
  • Size 45KB
  • SHA256 57152da75997444da1fd22951d7ab590a7f983471e836380146be3676144d53c
  • MD5 a1a036cb242d5f33a88f57f07cf1ff83
  • SHA1 dddf0e69c140ef978f61f05011bde0bd83ad56bc
  • SHA512 080456298e36f553c54d496529bf8fe690fd01e1cb499e31c52155ced2179a1c36866668f6d5a60e390a3ca6a9fdf95c4a16de5fa9ad8eb778898c2dfa05b66b
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4b9oa0y/zFOPIVzjbtg63iYTQBirIiec1pBDZ0x:8uUIpT4vAj2fadi3V3b66SYKir9eed0x
  • TLSH
    T1A423390037E8812BF2BE5F7899F26145867AF2633603D68A1CC451D75723BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2