Extracted

• • Target
    543149ed3a86029970aa6f8a29ac77da8c049c3d4199bc90a30e0d57a0f2008f
  • Size 45KB
  • SHA256 543149ed3a86029970aa6f8a29ac77da8c049c3d4199bc90a30e0d57a0f2008f
  • MD5 1148ad455b7ab85b5f52fa08a8b2e916
  • SHA1 99a6f042b4980fba42b7f67cea66d571099f911f
  • SHA512 06141b75d8ac96609b168287c2931b6e36574b06db0651458c0a6348a04b19b3098627e83ceaee0fb69d5796db562a55e18bc90b49f9838aa60d15547e8d8bf7
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAG8V1RpPEcPIMzjbBgX3iWXKonj69p0AdBDZMx:kuSOpTPOP2W8VDZEhM3buXSWXKoj69b8
  • TLSH
    T1DD232B003BE9823BF2BE4F78A9F26145467AF6632603D5891CC441DB5613FC69A826FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2