Extracted

• • Target
    d5533a3ab7627952f0b447c24495508c2ac9c9501dbc354e273ac5ed61884c64
  • Size 45KB
  • SHA256 d5533a3ab7627952f0b447c24495508c2ac9c9501dbc354e273ac5ed61884c64
  • MD5 a2a9763ae0a8b05f4c2429a473ff5772
  • SHA1 be61341a4825435503ec72d77a176311f093cf2c
  • SHA512 e8cf48a44dffd3718135dafbb3ebd366c46ac483748cd4ff31f909ff684161314fdc770ebfdd5f1b5a61d699eeb03241e611dac757b5cdea2ff14a0c33899831
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrXT9Qpm9PIZzjbngX3iX2vOkP0VDjBDZkx:vuogpT7I62AQZ3bgXSgHP0Zldkx
  • TLSH
    T1FE231B003BE9812BF2BE4FB898F26145867AF5633603D54D6CC451DB5623BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2