Extracted

• • Target
    c61b52c2e02360def2d1185464c9b3788786b129bb32c237059209cd1d12d58f
  • Size 45KB
  • SHA256 c61b52c2e02360def2d1185464c9b3788786b129bb32c237059209cd1d12d58f
  • MD5 43f3afd052229a729f51d6b656438819
  • SHA1 1f760e238ea5e64900f655d4575bfb2ea1aecd31
  • SHA512 c6e6c9d98e9792169a32b73ef2c9f80b858756c44ad04a73ea848042f43dc25f9a6807314d0572c8031efad86923a079947ec2b07f71e718520b169b007599ea
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYCDEbHB0jrOPI/izjbQgX3iD/p8jlwT4gjPtUBDZ0x:8uuSpTgyf2qySf3/i3bXXSDx4e8gjgd2
  • TLSH
    T1F8231A003BE9812BF2BE4F7899F26145467AF6633603E64D1CC451DB5623FC68A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2