Extracted

• • Target
    748fe77dcf5d21cd6bde45bda66b0b8bcdca65f5529b16aa6dd585397d3040b3
  • Size 45KB
  • SHA256 748fe77dcf5d21cd6bde45bda66b0b8bcdca65f5529b16aa6dd585397d3040b3
  • MD5 2ec3c232b62e73fc57ccd13ce88f5b27
  • SHA1 332ed4b58b10f551e8b78ce0e88bb981cf5d07c6
  • SHA512 f93038c12f6b7b0d4f1fe326339a5e7eaba94eeb98518b466f9897bff5a67106c27276f5e1b6d525b74015c197acd50b70c5eb1e672cc3e32d7eeb9ee680071b
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAvnCablx3APIfzjbigX3aIGk+42wCpjFPbBDZcx:UuKWgSJTwRf2/jb33lf3bFXqIuCCbNde
  • TLSH
    T1BF232A003BE88127F27E4FB8A8F25245867AF5637603D64A2CC451DB5623FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2