Extracted

• • Target
    df4ac54fe10363a7f219ade74f66daefc443fd6a63dcc0463191fa52ba8f94ca
  • Size 45KB
  • SHA256 df4ac54fe10363a7f219ade74f66daefc443fd6a63dcc0463191fa52ba8f94ca
  • MD5 5832af127d23395e887886388923e151
  • SHA1 49989995e8507a2f243b9f17244d755f0b2facb5
  • SHA512 cfe5868815628cd02609ddf934cfb81398e8a8ed4f6f43dc6f474d968741a83e03d175f3882d2ff7c5d495ec283724b5c965ee33d5da1f2e469ebdc70dae17c9
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9zCOtTMtPIAzjbygX3igxxm0DFi3jZXVB0AmBDZsx:EulCJTHl42MRvA3b1XSgxA0DU3p0Aodu
  • TLSH
    T1D2232B003BE8812BF2BE5F78A9F26245867AF5633603D54D1CC441DB5723FC69A826F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2