Extracted

• • Target
    bd5585864035ed4a3c94591cb391629dae49ada51acc53bf4edd0912c653fc8e
  • Size 45KB
  • SHA256 bd5585864035ed4a3c94591cb391629dae49ada51acc53bf4edd0912c653fc8e
  • MD5 16717d9e5d9c475dbf3cda5be8efc2a3
  • SHA1 7f6e88fdfd20d2af243c0a65db5479b1017f20bd
  • SHA512 772587f3890037dc132bcc0343cfc6991df7f6f7effceba3f6e7aabfffee5f460c1feb32524bbc3b27e99e7dbe79d575c89f8c79139cdb049556bae3ce876983
  • SSDEEP 768:cuqb5TrIGuCWUoKXMmo2qQ/ZTohEaSPIYzjbngX3iMtQHR6+eO2JoErBDZUx:cuqb5TrhG2F4Ea7Y3bgXSjT2yidUx
  • TLSH
    T1D0231A003BE8822BF2BE4F7899F26145857EF6B36603D5491CC411DB5723FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2