Extracted

• • Target
    58671fc70efc785cfd5f477bfcecd348bb46083e2de335ab8ebb7a2e39190222
  • Size 45KB
  • SHA256 58671fc70efc785cfd5f477bfcecd348bb46083e2de335ab8ebb7a2e39190222
  • MD5 f9268edaf8ef1b54bbb66d4643ef6116
  • SHA1 b9942f917f0a2890859b8c6a989d1b105a56a411
  • SHA512 a5237360a7ab38e49862fcfa2c3cc72a31ad0504706a34a6fcd01d684f75709b005193c4c71253dab61f181d2db0c7cbcfb912003a5140927d1e1f4ebf9b18b7
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrvBzCQKx7PImtjbqgX3i69Z4Hm61BDZkx:vuogpT7I62ko0mlb9XSG4Gydkx
  • TLSH
    T1C6231A003BE8C12BF2BE4FB899F26145467AF5632603D64D6CC452DB5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2