Extracted

• • Target
    de17336c0d96b96e186ad988421a4bef60b0464b6f5faf189c9ecf7365804b77
  • Size 45KB
  • SHA256 de17336c0d96b96e186ad988421a4bef60b0464b6f5faf189c9ecf7365804b77
  • MD5 4f1253319a744c28ac3bf0723006b30a
  • SHA1 2e4d05cbc9a19585ac235cdf5345ca19b40ee5e0
  • SHA512 d33f12a4b4f689f56169efe9570c7897c82de7462ee04fc2d0a5da57c2bc69ef41909f11f7d68191009cd83618fc34f58d7532d1d01954c2d497c9a13a663109
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlzfBohEa+PIv/jbogX3irb0rNZww6p5MITh/fBB8:wuDWZTpMZSB2S4EaHvLb/XSXq4TldMx
  • TLSH
    T14B232A003BE8822BF1BE4F78ADF26145867AF2737603D5491CC4129B5713BC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2