Extracted

• • Target
    55f675e9f0b27e1828cd38ab258f6de3076cc0541ae4425163a1ef9d0cc5b6ae
  • Size 45KB
  • SHA256 55f675e9f0b27e1828cd38ab258f6de3076cc0541ae4425163a1ef9d0cc5b6ae
  • MD5 98d7676c50582635262110eb1ccb4099
  • SHA1 975426471c4b2d69af47a6b3c6d226756c1cdf0f
  • SHA512 44e0f3dc64e99e08188a474e12b46ade17d90235c49214f33e12f32ef41428675871690eb586422e4b3e31a0685a4e5d024797c9059e6607de91b9dcb24b067e
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qF+UJ+XOoJ9hU/NPIEfzjb/gX3i8bbhnFDTrMABDZUx:cu7e5TH2A2DU0eI9hyqEf3bIXSwtVnV0
  • TLSH
    T17B230A003BE8812BF27E4F7899F26145867AF6633603D54E2CC451DB5723BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2