Extracted

• • Target
    075adcd32aeeed09aacacb54be077bfc06e9794e4bd51dc4113d84bf065ad6f8
  • Size 45KB
  • SHA256 075adcd32aeeed09aacacb54be077bfc06e9794e4bd51dc4113d84bf065ad6f8
  • MD5 39ce1aae0d18babfb7af0d60bf4140c5
  • SHA1 ecafe1173fc70e1391df49c7d871a0502b8f391d
  • SHA512 a629fc86dd7ae4052e0cb026f8f9fa8c18b6e0ce8ed6b1da68c533c77c3e0c80c007b39aa49468f30383847f46abd76d6cd76dc8cb42a9040a806ac8449d994e
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q94O5QyCBjHSNjPIwzjbEgX3igD2ODr4MekDSmtx7rC:EufspTf2g2hO59ESKw3bLXSg1Df5DSme
  • TLSH
    T1BB232B003BE9C12BF2BE4F78ACF26145467AF6636603E54D1CC451DB5613BC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2