Extracted

• • Target
    574586a90a13c65395a1426ba64fd0bb3c81674775ff824fcae2966828afb139
  • Size 45KB
  • SHA256 574586a90a13c65395a1426ba64fd0bb3c81674775ff824fcae2966828afb139
  • MD5 18a51ccf1f0c8eddcfa3d64eece9eff5
  • SHA1 40b888f438a54c581c08463eb737ce5a4cd8edaf
  • SHA512 70c6eedb6d38c9309b272177ab3bc16cf3acb6e581ff72f19c75729e9f8bb4b6c8d9a765e7e47dae9c6c20fc9baa2210b46be0b9750c4942ac967052a1ed845b
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9x/cYssPJZOPIcvzjbogXviCeGYcRDByBDZsx:EulCJTHl42eMIf3cv3b/XKC5Vmdsx
  • TLSH
    T1B62319003BE8C12BF2BE4F7899F26145467AF6633603D68E1CC451DB4613FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2