Extracted

• • Target
    2787163bd34a08b3fb0da45615968addc59ba408a8c7df4e3fca479414f683fd
  • Size 45KB
  • SHA256 2787163bd34a08b3fb0da45615968addc59ba408a8c7df4e3fca479414f683fd
  • MD5 f0efbce673a8d1c24099e03d511b08e2
  • SHA1 1a9b126a2fe328a9013ba4914d4cb58a392cf817
  • SHA512 a6e751fdfea841237b94d7598d85ee1ed0589d78da64346b50a986f7178d9f72a93c375344d7908dc01eadaba1ae6ab25fd41e77d1b678613e1288275ada7e7f
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV2maPylF3APIFzjb3gX3i+UxJZtxNVtx+c5BDZkx:suJdpTPdI2Hfyv3lF3bQXSfJDxNVtEsk
  • TLSH
    T1352319003BE8812BF2BE4F78A9F26145867AF6636603D54A1CC451DB5723FC2DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2