Extracted

• • Target
    7638d2505aa45674d8553049cefa1bd727f0ec440b0d7a472205812b0867bc88
  • Size 45KB
  • SHA256 7638d2505aa45674d8553049cefa1bd727f0ec440b0d7a472205812b0867bc88
  • MD5 3053c956a72ab3d1de22493f04c33ccd
  • SHA1 b967fcc7c7729e27327e26d4b6b47dd7521f1084
  • SHA512 750dbda36ba57a6bd15ddae9f870bbf5d07cbfc3f4a07162fd05907b6bb4d4ebbb855280146ee7eebdc39eea2a3396fe864b34583b30eaeea73e191ed321b5e1
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaL5P02FUFdxYkk8PIZzjbrgX3ioBvu42sEVBDZMx:kuSOpTPOP2KLDmWBZ3bUXSoBKsE7dMx
  • TLSH
    T198231A003BE9812BF2BE4F7859F26145867AF5732603D94E1CC451DB1623FC69A43AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2