Extracted

• • Target
    5d4b35544b1973db82aa89a4916c7963b553962aba6c4c3a39eef05c2bd26bea
  • Size 45KB
  • SHA256 5d4b35544b1973db82aa89a4916c7963b553962aba6c4c3a39eef05c2bd26bea
  • MD5 cebca2152a0bc970df7974fd120424bd
  • SHA1 23a58e1514394c56df72afe0bc7adffa8c38d264
  • SHA512 b63ec20b7d3a4b1883ee459202994f89a86761b46ce955295cf4422171fab13a024ee2dc652f1bdd47180277726a099cd282b0dc7fc78a7645d15b839e3364c6
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9VCqtTtoPIkzjb/gX3iEQG8FLWPgxsbqBDZsx:EulCJTHl42ql3k3bIXSEV8FXsAdsx
  • TLSH
    T194230A003BE8C12BF2BE5B78A9F26145867AF2773603D54E2CC4419B5613FC696426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2