Extracted

• • Target
    e431035ac75b43556d820c6ada5c17071752b461fadff306fa51ac477327c7c6
  • Size 45KB
  • SHA256 e431035ac75b43556d820c6ada5c17071752b461fadff306fa51ac477327c7c6
  • MD5 674a08500387fc77dfd727f4e849b324
  • SHA1 422a8a5da95a2964c89045e1af1c0ea020761539
  • SHA512 eee7a2f2c8a8825023b9a7c0d353a44ee500458b80727953ca0bb048c1699e044b9ac199742c4c837d8dd63c8f21aaf78ecc157c775220f88b0972e64abb817e
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAaL5P02FUFd8Ykk8PIhzjbEgX3iTM1WpmusjDDxOBDo:kuSOpTPOP2KLDmTBh3bLXSTqGnsX+dMx
  • TLSH
    T129233B0037E8C12BF2BE4B7868F26245867AF6736603D54A1CC451DB5B13FC68A436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2