Extracted

• • Target
    2263501981d5733127920250f4a971457a0b398db8edf71de2b354e3a5450781
  • Size 45KB
  • SHA256 2263501981d5733127920250f4a971457a0b398db8edf71de2b354e3a5450781
  • MD5 ad013484f73853cf459e1c21a086b891
  • SHA1 056245bf65aa2bcfe26a0a65c27b45464463baa5
  • SHA512 369de2478a30685fc34426f6d592bdc00e96df3d9645f76d9569e0f8fd0f690e5aa933ed23e5eb9b7a5208c09e6c7862d81c201c74e32040376c58ba889dd3fd
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qY6iaLzwJAOPIcFzjbPgXWikF1SQaf4PGKODTBDZ0x:8uuSpTgyf2i5U23cF3b4Xfky4W1d0x
  • TLSH
    T1BD232B003BE8813BF1BE4F78ACF26145867AF6637603D58A1CC451DB5613FC59A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2