Extracted

• • Target
    28601f662034a16650ce525ba33982215ddad04a9bd2ae56ce06446000fafd3f
  • Size 45KB
  • SHA256 28601f662034a16650ce525ba33982215ddad04a9bd2ae56ce06446000fafd3f
  • MD5 a19dc1ed3c2e446a20c0a2726d92a6c8
  • SHA1 99fe11dff8ac5168660704cbb7fa156c2d2be69b
  • SHA512 2515c506b14713758ebfc1cdfde4a89f7f890155d334ef07b545e661aaa7148f6c214f2301ad67e17a6d1b598cdb31df13a09ad9ba85de8ab600f5266b835d7a
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjoO5QPCBjPSNjPI/zjb2gX3iYKnkD4MZBDZ8x:0u2vpTDe+2vO5sMSK/3bpXSFkD4MHd8x
  • TLSH
    T13D233A003BE8812BF2BE4F78A9F26145867AF6637603E5491CC452DB5613FC2D6426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2