Extracted

• • Target
    5690c201eff1231a1d66fdee89eea9f0805055b4c50857162d2977cac6a8e809
  • Size 45KB
  • SHA256 5690c201eff1231a1d66fdee89eea9f0805055b4c50857162d2977cac6a8e809
  • MD5 25897be7af316a9f889ab6da0bbc3749
  • SHA1 1ee1822cb5b0fd48d831a3037e600f5350580011
  • SHA512 eed0d980b0d5eefa81fb535f262c10b826f53a930fc1f65c4fb09b23bac6914feac9beb04810a685f53c01ef3ff395a65dabd62bd59935369fc44aacee1ab22c
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY2RzMwcOPIxzjbSgX3iuzO5Lf8X5wtuBDZ0x:8uuSpTgyf2iAd3x3bVXSQOL8Xmgd0x
  • TLSH
    T1F0232A003BE8812BF2BE4F78A9F26145467EF6673A03D5891CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2