Extracted

• • Target
    5074c7fdc57acfb62fbed3503378b2af6e9d702e7b6405ebec5a4d5ef2db1e51
  • Size 45KB
  • SHA256 5074c7fdc57acfb62fbed3503378b2af6e9d702e7b6405ebec5a4d5ef2db1e51
  • MD5 1ffe312fadc42254106516980b5bf0c9
  • SHA1 a573e8d1167caaf6e56c6fa9addd15bb28066529
  • SHA512 249b8646afc705664885cdcba089f4b5468b99a9ec603719a7785178192856a04f61f6741c886e1fb0372b0b15278da0eb13bc49c190ce76341af554a1042339
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ+eeXK5oPTN8/nPI6TzjbKgX3iSUuTHUIZtVKVsjBDg:cuqb5TrhG2LeE2TNKA6T3bdXSmTHHmk0
  • TLSH
    T19C231A003BE8C12BF2BE4F7899F26145867AF6633603E58A1CC451975713BC6CA52AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2