Extracted

• • Target
    54f2451a036a8e4de179dd6b6ab98be5d092f21e318a85118eebf84f3aa0cd35
  • Size 45KB
  • SHA256 54f2451a036a8e4de179dd6b6ab98be5d092f21e318a85118eebf84f3aa0cd35
  • MD5 363aeb361e40d05702ce79f543b3bd84
  • SHA1 222bb3c092b3d46fdee96216c38634c6831613c9
  • SHA512 5c4ed2b6f415240b66264d8e02c232fbdf63ffa421cf9f658168cc718f38b95afd8a8dfb0c2bf3533db16344e08bfb62852bae137c6f16ab55e37cf27b3e138a
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/cYssPJZOPIcvzjbogX/ijt65Zbm/FbCg4bnOBDZu:EulCJTHl42eMIf3cv3b/X6jt6LuFbCP/
  • TLSH
    T188231C0037E8C22BF2BE4F7898F25145867AE6673603E58E1CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2