Extracted

• • Target
    2585515c5397dcdb34c88dfe258a94b8c46aa6375e5467fc4fd8e580981f5f9b
  • Size 45KB
  • SHA256 2585515c5397dcdb34c88dfe258a94b8c46aa6375e5467fc4fd8e580981f5f9b
  • MD5 b2f81cbc35af4a12e2435fc1a4f4247e
  • SHA1 a5e29fd16f844e90b8731feeffed32217a14b7d6
  • SHA512 538d8a5d9af66702505f8cb84bae00f6e9b0f56082a1e2df2b3e48db1520e1d0ab1cae3245574b6c32072504201e3bc60626567b059b6f065c7a199a94e345bc
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwI3HO4SNMOPI0mzjb1gs3i1B72AA8JLXkjBDZMx:ku40ZTXEb2M+JM30m3bSsS1B7nDJLGdO
  • TLSH
    T12D232A003BE8812BF2BE4F789DF26145857AF6637603D64A1CC4529B5713FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2