Extracted

• • Target
    c17a2bb4c02df30894f4293b7ee2ee00b43ef159902e89d2ec14b4cc5cf7b6c2
  • Size 45KB
  • SHA256 c17a2bb4c02df30894f4293b7ee2ee00b43ef159902e89d2ec14b4cc5cf7b6c2
  • MD5 c753e7786a535cf155af5cdec32839ee
  • SHA1 7209bfad4514a232092a9372956478d6dde01afa
  • SHA512 84192aa7e100dad48a26c01f02cd990f691b9b9bae8250b1d007c38006f6b5ca5a5b5a9483e898a8a41cd8901f37d22510fc2e2cc7d4eb8a76a9d7ca8b676c57
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q96DEbHB0jrOPI/izjb2gX3i9brngo+reBDZsx:EulCJTHl42FySf3/i3bpXSNkrwdsx
  • TLSH
    T143230A003BE8C23BF2BE4F78A8F26145867AF6637603D5491CC4529B5623FC59A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2