Extracted

• • Target
    caac31bec7bf1206f5f01a8c1b9e6c35be85656d1b9ed838e062fb78644cf5bf
  • Size 45KB
  • SHA256 caac31bec7bf1206f5f01a8c1b9e6c35be85656d1b9ed838e062fb78644cf5bf
  • MD5 56edd2ba8b5527833d5e18c8f22b6ce7
  • SHA1 633fc14459a009a86386c8762b7ccde698971ad3
  • SHA512 6cb4e3f381008afed76822be44f0945391165e5e67be4a8435050a93c46a0d0c4454639f14ab7c3534ea586994c0af40e2aa8c3d23edd65b26d87d57d2623792
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAqqyx0OFUwdrxIkDPIkzjbagX3ialuKMBDZMx:kuSOpTPOP26qKTNMk3bNXSaYDdMx
  • TLSH
    T16D233A0037E9812BF2BE4F7869F26145867BF6732603D54A1CC451DB5723BC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2