Extracted

• • Target
    375e5364cd4bfffe870abb34b79f1ea46e089f6797f062091c8fce8ec1315696
  • Size 45KB
  • SHA256 375e5364cd4bfffe870abb34b79f1ea46e089f6797f062091c8fce8ec1315696
  • MD5 819f8765e9909c449a136e8390d2141c
  • SHA1 414bd00084b9b83a64d8b2471e7ae3cf025f2d34
  • SHA512 3a74cb6c3fd83e1d5d0f803ae38a8b68574bd1d6b9f2d3981ed267ffb8957cabc733cae96894ff3215e328e9bcd1408f9df398a0a5894e5ee6f02099255ee95b
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaLiE0yFjrdj3kk8PIhwjb9gX3iXWYbQQwdT4RBDZMx:kuSOpTPOP2KLBXDBh4bqXSXwMvdMx
  • TLSH
    T1E7231B0037E9812BF2BE5F74ACF26145867BF6732603D5491C8451DB5B23BC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2