Extracted

• • Target
    d60974cf8b6b5d174d3fae00109f6f1fd1464468bd6a06352f7127266bbd84c4
  • Size 45KB
  • SHA256 d60974cf8b6b5d174d3fae00109f6f1fd1464468bd6a06352f7127266bbd84c4
  • MD5 a2c7d4f3d12cfccb2191b6d51cb9c3bd
  • SHA1 f4f5714ffa4b1d9840bc98b52a0bb647f2356f48
  • SHA512 f52a6af62fc35be478a9b927b042978df8b4953ca6f1a65792861b7a919c594c28d98ac17c4e7f7c9c0a41b4a19d4a651dfe42f93645b61be66909e44349f87e
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fLiE02FjMdjYkkmPIGzjb4gX3ivW0Ry6dIBG3RUkB0:cuR0JTPjY2SL9wQPG3bvXSv5X8GBLdUx
  • TLSH
    T132231A0037E8C12BF2BE4F7869F26245867AF2736603D64A1CC451DB5613FC69A436F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2