Extracted

• • Target
    dba1e18e27cfb06f30ea6a1af294ef1d88cc21216818ffa3dcfa8fe9ea6ba714
  • Size 45KB
  • SHA256 dba1e18e27cfb06f30ea6a1af294ef1d88cc21216818ffa3dcfa8fe9ea6ba714
  • MD5 817bc95bee2b11a8539959e3074eff74
  • SHA1 669ae94899bc0dcc439fa28c56e19d014b0d44cf
  • SHA512 94b40a1646890fa41985b5bef540cf099c66a3fd7b84fcf403f66f3fea5476c0f13d062fabf73a7229e23df935025a8db82a98f31d192cde36f8b52ff7e968fe
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA/+GtCVnJtHuPI+zjbggX3i6xwHuXEhGwBDZcx:UuKWgSJTwRf2P+TB3+3bHXSgX2dcx
  • TLSH
    T18A232B003BE9812BF2BE4FB898F26145467AF2637503D94D2CC451DB5613FC6DA426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2