Extracted

• • Target
    7566e5334238013966f8d6025ad92a3e20e29310b7599cfdc57614918e7748f7
  • Size 45KB
  • SHA256 7566e5334238013966f8d6025ad92a3e20e29310b7599cfdc57614918e7748f7
  • MD5 154548cb8751359e8b5fe158c76c1b82
  • SHA1 35479c6794b8903fd02f32f3e15b395801d60ef1
  • SHA512 c088273ca160310a330ba4a63411dd27842c63794814afacaa3193bccd7e3748992f5175e671804a2e8fd479a5d952a103f2ebb121fa8239968e6e4ad8fa6320
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYfDEbHBOjTOPI/TzjbogX3inhEwnnrjWUBDZ0x:8uuSpTgyf23yYf3/T3b/XSh7rjWid0x
  • TLSH
    T1A2231B003BE8C12BF27E4F78A8F26145867AF6633603D94D1CC4519B5613FC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2