Extracted

• • Target
    upgrade.exe
  • Size 112KB
  • SHA256 9a567dd914498730abc22256f066f7db3f16d859febab7f4542c1c5c771d8bb7
  • MD5 944fcb4dbe6e15ab74c3416715dadc34
  • SHA1 6a89cbe282af71a8ca40fc11fe94b7b0ccf03643
  • SHA512 40d0d6df2e3194f3ee20d98b5572cd30be37e6834424fcf0f5dd628318fa14933992aa6b86438c33452b9327c45802767c5305dc86680d28a15f981f2b4c7398
  • SSDEEP 1536:7uTO9TgQCv2IK0efbDXSctkBSKd6tKrqi35Rwa3:7uTaTg7v2r0efbD/tmFpPwa3
  • TLSH
    T1B8B39F30EFD7B036ED6E0AFC5CA37171492565D3250EF57AFCC0329746226C1A9326A9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2