Extracted

• • Target
    5321dc72118474e51c898f83a6a32dbc0b8113b029a9ac21cb2082c9aa0b495c
  • Size 45KB
  • SHA256 5321dc72118474e51c898f83a6a32dbc0b8113b029a9ac21cb2082c9aa0b495c
  • MD5 d35901a42769ce3402f338e592974ca8
  • SHA1 85021231a5bd2b11940d18d88517269a3acd7c1a
  • SHA512 b1cd785074305949109aace2f2c3add65622befc0cb825d5483c4a256addd506a46838535529f11b452baf0ebe9ec80d0f1bca8049b4c753b1cca95e78438b39
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q17xJdxrPHuPIbzjbhga3iQp0smeBDZUx:cu6YepTPso2exR3b3bOaSO0stdUx
  • TLSH
    T1F6231A103BE8822AF2BE5F7499F26145867AF6633603D64D2CC441DB5723FC68A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2