Extracted

• • Target
    ddd4e5d8a217db9823ba3f6261bd45e975b0f274f9b419bc3d3096b7687f1ac8
  • Size 45KB
  • SHA256 ddd4e5d8a217db9823ba3f6261bd45e975b0f274f9b419bc3d3096b7687f1ac8
  • MD5 bf72c223d5d544d278790ed4ded0cd9e
  • SHA1 4177035e6becfaab0c1f68cfc8716e80d443def1
  • SHA512 1b91d7885751ed71665033fbc84ff5b582a3a2ab037f54584bad5bf4e07524cd77a2487c42f67154f4fa6fe41c1ffb312d748795ca230e92b7275111fde778f3
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrYBz3QKx7PIQejbZgX3ipTEBHjKtnhQYI9SLLHBDQ:vuogpT7I627V0QSb2XSpTYHOtVf3hdkx
  • TLSH
    T179231B103BE8C12BF2BE4FB49CF26145867AF6632603D54D6CC4529B5623FC68A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2