Extracted

• • Target
    42ce0d83eb80da860075c76e158a00206aea12a9836300901d02ebfe752261c0
  • Size 45KB
  • SHA256 42ce0d83eb80da860075c76e158a00206aea12a9836300901d02ebfe752261c0
  • MD5 61f8050e28187cf0f70c5bf5aa5e4c03
  • SHA1 b68ed4c7786ef88f7a7f60c4ebd25167b40e30fa
  • SHA512 ca457677f2281493c9cb5e342507732611c1a51046d08e192200446bae396028a106c15e6855db031f7b1e3f17791609cb23a27a946de467c55e7ce53005dce5
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVyL5P02FUFdxYkk8PITzjbVgX3iLtN6uaQfiiXnz8e:MuBGJTPho2/LDmWBT3byXSLtNV4iXz8e
  • TLSH
    T136231A0037E9812BF2BE4F7869F26245867AF5736603D6491CC451CB5B13FC68A43AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2