Extracted

• • Target
    a5664ee6ef838497efacd343f98bced3838668f9076c9802de604b476fabb123
  • Size 45KB
  • SHA256 a5664ee6ef838497efacd343f98bced3838668f9076c9802de604b476fabb123
  • MD5 5f76865aa3b606b40d2d1467f07b2de8
  • SHA1 ad36b592d39232a1e0cc1e07f580c8cbadc9137d
  • SHA512 287288e186a13d5aa202744d74cc8c62737606e8e745b93132009e5d568ce8ef23a45e4f882a86cfb56976b5c31d7e010206f7f1e6876c00ad6b74fc6976ec83
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNrzjHynaKPIsYjbDgX3iOF6MwP/y4BDZ0x:5uSy6pTpoo2onZsQbcXSuwPd0x
  • TLSH
    T1E4232A003BE9C12BF2BE4FB8ADF26145467AF6633902D5491CC4119B1713FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2