Extracted

• • Target
    538f786a42b75f98e80216a9d0e634cdef1604eef81e6e0517717dea6fbfa37a
  • Size 45KB
  • SHA256 538f786a42b75f98e80216a9d0e634cdef1604eef81e6e0517717dea6fbfa37a
  • MD5 4caab84f4e88efa6166d2af96edec1e3
  • SHA1 0a668ce132aabddeced3aa8d5fe066205e2e4194
  • SHA512 def0078a3c6d3034311fe13d92ca7055f40ca5d431912dd2a214e34db29267ddb8a23e7ec606443c40d8eeb7404fba96aca557a54e5a992dd97f5ae97656d0ff
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2ql3AuXueM+D58vnPIM9zjbfgX3tf6Ib78LQwRaC7u:wuDWZTpMZSB25uznD5iAM93boXdf6eYG
  • TLSH
    T1F2233B003BE8C22BF2BF4F7899F26145867AF2633603D94A1CC4519B5613FC5D6526EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2