Extracted

• • Target
    a5e55f1efa7c479080db4e3383babe4118e60176a1dbaa499e82bfeedcc6d7f2
  • Size 45KB
  • SHA256 a5e55f1efa7c479080db4e3383babe4118e60176a1dbaa499e82bfeedcc6d7f2
  • MD5 000758c3cf72451a8881d1e08b07c217
  • SHA1 f25feeea0dc7491320bf9ebb9d12fa1d0cde0c51
  • SHA512 4630422ce2360f0dd5a3d34d57dd4b11db04e64ff0fe74c913a2b7149100559fcfeb49076976072cae5e4a59664118c96b5cfb8a33248c2d4f73738a375c8b1f
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98zjHy/aKPIb+jbrgX3i6xlXBxjrNqBDZsx:EufspTf2g23nhbybUXS6jXBxPN0dsx
  • TLSH
    T161232A0037E9C12BF2BE5F789DF26145467AF6633A03D6491CC4119B5723BC69A02AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2