Extracted

• • Target
    7514b9300b19107f0836f54585c7dade6e8d1bcb7593e29a730b624c38cbb5a1
  • Size 45KB
  • SHA256 7514b9300b19107f0836f54585c7dade6e8d1bcb7593e29a730b624c38cbb5a1
  • MD5 088b3241c46050eec89a6f500b80ef66
  • SHA1 cc52790fd94705f7befa95f40d6d5146b40f557f
  • SHA512 ff485cd9c1fe876dba77689c68eb749393977f17e06330781da0fc4fbbc73b73718656aa6842c252a80a36431d1dbef96ca7e0670cb90cad96df58fd10a88979
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qr5w0Q+KXPIpzjbYgX3i1bWvrtspF7wBDZkx:vuogpT7I62Q9p3bPXSFWjw5mdkx
  • TLSH
    T1692309003BE8812BF2BE4FB898F26145867AF5637603D64D6CC451DB5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2