Extracted

• • Target
    b553b7719d2d75b716e449a24f5e54080cc2490a937b11c0677fc65c34df90d9
  • Size 45KB
  • SHA256 b553b7719d2d75b716e449a24f5e54080cc2490a937b11c0677fc65c34df90d9
  • MD5 ce178615f135b9648b9c1179a5af6b00
  • SHA1 c54668d64f12877dc3abeedb60874d22247751a5
  • SHA512 7d17368a34a6044c3b6282501255828a5a444dd04edcb41a9bd3078fe083a73b01572b7062925e533ef137733bb4b2395626e259f0a32eca3bc2d77b484df924
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1LT2QAm7PI1QjbBgX3ikOa/7HlAP/RNcXHZPopB0:cu6YepTPso2JT1YbuXSkT/5eQXHBSdUx
  • TLSH
    T136232C003BE9823BF2BF4B74A8F26145867AF6633603D54D2CC451DB5723BC686426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2