Extracted

• • Target
    09274985126eec35d9e24ac1a47e57d87445146ad0e639fb7dda935e29593449
  • Size 45KB
  • SHA256 09274985126eec35d9e24ac1a47e57d87445146ad0e639fb7dda935e29593449
  • MD5 c685332fe593d92ec233f7448ef33e78
  • SHA1 0a69110a81844d2f98b2ae506f47083db2b79995
  • SHA512 564b863883fe807b47310eb8adc1c457cb78ee6e9b0eaad23257ad0341783326663e9a20c6693ab1005bcc6b8aa609acddca42f59ea3fb5aa28505098d422e29
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwIeeXKSocbbbQtN8/nPI6kzjb3gX3imaUo/J76TBDo:ku40ZTXEb2VeH2tNKA6k3bQXSLUo/qdO
  • TLSH
    T1EE231A003BE9C12BF2BF4F7898F262458A7AF2672603D54A1CC451DB5713BC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2