Extracted

• • Target
    825da52245a5b4265f5cc0290258b42bebd927e2c016a567aaa5fbaa284e540e
  • Size 45KB
  • SHA256 825da52245a5b4265f5cc0290258b42bebd927e2c016a567aaa5fbaa284e540e
  • MD5 7dd6546bf08908d724967ead36822d26
  • SHA1 8cd4312c80c7cbb74ce94fa628b1506617175458
  • SHA512 cb35de7c0b274d821a420f76bf2c34c71e35013caf6dcec2cd95af20d42d4d63f0fa12766d1f6ceb7718f8e6aacd1c835d944e62015d073910ab41f9d2f0105e
  • SSDEEP 768:MuLAZTnAkuSWUYzG8mo2qF63xq6YFoOPIUzjbNgo3i4X84hHwshIY3vtBDZEx:MuLAZTnbg2Pkxo3U3baoSUhHD+KjdEx
  • TLSH
    T12C233A103BE8812BF2BE4F78A8F26145867AF6637603D64E1CC451D74B13FC68A526ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2