Extracted

• • Target
    d3e520754ae1b5b5c6b7a9425e721037db1e75b537d0891d199e4bc2d7ea1d8d
  • Size 45KB
  • SHA256 d3e520754ae1b5b5c6b7a9425e721037db1e75b537d0891d199e4bc2d7ea1d8d
  • MD5 61bb6b00a27db7d267a0f815d158f1b6
  • SHA1 b14dbd55e03785deaae3a1f932e440dd8968cf58
  • SHA512 960f8279c22792f3f72ebe9748b2ac278a61929a21232ec587460cc0214db868c7854a40defb098259948183634cc5f9013dbf5aed0cfe34ac76a6b3a0fab456
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9ZRzMwnOPIZzjbQgX3iNm/M2jNbkzLI4THeTBDZ8x:0u1YJTHcw2SA+3Z3bXXS00gbkI4S1d8x
  • TLSH
    T143231B0037E8822BF2BE5F789CF26145867AF6673603D68A1CC451DB5613FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2