Extracted

• • Target
    5e194bb617029c4e3f2936dde5f68c445874fdc9b15341efdc42b5e221987073
  • Size 45KB
  • SHA256 5e194bb617029c4e3f2936dde5f68c445874fdc9b15341efdc42b5e221987073
  • MD5 d59080db647ff3f0278345f18f5b0c4b
  • SHA1 3fabf6e137556d0797d02ac0c390c1a96ecbc35f
  • SHA512 56ea6d4989a192b82341c1c0b4bfb33f6f7b3a63b52962025ad68326a46c523fdcf18bd5461d2f071436bc6c5a92e9f79b54fd4531b0b9024c7c5ac452cac2f1
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrXmaPcl83APITpzjb4gX3inwo7MwRpsls3oIIrEBk:vuogpT7I62IfcS3lTp3bvXSv75AMo5yk
  • TLSH
    T15A231A003BE8812BF2BF4FB899F26145467AF6637603D64D1CC451DB4623FC69A42AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2