Extracted

• • Target
    62769816616a103b2d95d64cdff0ef8e0836c85fc72f6e5db1e9814b245f1e5f
  • Size 45KB
  • SHA256 4a55231cbd46cff7c5517ec084987f20ba3d1380625a4f0a381f7e7534d3fb88
  • MD5 f8f537a7319dfe91daf89362df4afa30
  • SHA1 83d1816dd97f9156a26d6e8cad7b184854433094
  • SHA512 1dbaf52ff70f98edddfd0c4ff810d09aba5257958d7af597fdcbc3455d4f274a645ded3b6b185d134dcee7d92ac43dcbe00fa84c3ab87a7ab5e3fa0a9dc3930c
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVs+GnnVPJgHuPIVzjb4gX3iFFM2zZcHBfCKhT2/awpG:suJdpTPdI2n+o03V3bvXSvMyYK+4dkx
  • TLSH
    T1F8232B003BE8812BF2BE4FB85CF26145867AF5636603D58D2CC452D75623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2