Extracted

• • Target
    c0995621e50693a75ba7e581b5a1d7af41412b239a57b4b57063c4fce1c53e8a
  • Size 45KB
  • SHA256 c0995621e50693a75ba7e581b5a1d7af41412b239a57b4b57063c4fce1c53e8a
  • MD5 375218d0e75f2eed66c13025f9fc1155
  • SHA1 267622495060b7ee36930fff4bff4dc22d6820ca
  • SHA512 337dc8e282e1d19a28ac2342d5042ad841875e56fbc5ab76bc1c7bd520ea911a73311ce33de84d46be9980ae92eab41dd43e1561d3444bdb52aa1d6113b08978
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4DqAYaayNPIHzjb0gX3uKeJ8xOE39hyoUBDZ0x:8uUIpT4vAj2nqzqqH3bbXeOxPeoid0x
  • TLSH
    T164233B003BE9812BF2BE4F78A9F26145867AF6633603E54A1CC451DB5713FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2