Extracted

• • Target
    273311f9a22279d6cc58430c04160b1f8e7801b158d812814a3fede177450004
  • Size 45KB
  • SHA256 273311f9a22279d6cc58430c04160b1f8e7801b158d812814a3fede177450004
  • MD5 2e298f790c40992d069f3c20fc88ffcf
  • SHA1 5a4f4c1b9118b59a65ad1b61ff959c9725431d25
  • SHA512 9a915d614cea62915d92e8b26f7398c9bd1916eefacbf0479cd3a7bb07b0ae73a3ecb9ad0d615bbce7dec9a6da79d5fbba729a6273f2723b0b9c2704020234cd
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q16T2QAm7PI1Ijb9gX3i0/LgPY2wTzjwBDZcx:RuxkJTgip2mT1gbqXS0TSFdcx
  • TLSH
    T1E7231A003BE9813BF2BE4FB898F26145867AF6637603D5491CC451DB5A23FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2