Extracted

• • Target
    dc98e55f1f0c111f928aa2870b57ab7cb78f432878a58b4495665fed1daae8b8
  • Size 45KB
  • SHA256 dc98e55f1f0c111f928aa2870b57ab7cb78f432878a58b4495665fed1daae8b8
  • MD5 9c1743976de82f8c98da564333dda9e0
  • SHA1 48b4cbd646b42ffbbfcb503222f0128c2cd9fd59
  • SHA512 d70a998cb53f089a081c4674b2d1ab2b2df0c35a4b76789a7a9fb76b4d794d82e21c5b5d68e6fcf013f4c45cf58f3f443fe38dd053ef5aa033a055ea91d03409
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4D9YSkqXzNOPISzjbpgq3i76xYD2iVJRBDZ0x:8uUIpT4vAj23aVq3S3bmqS7DDzjd0x
  • TLSH
    T1F6232B0037E9C22BF2BE4F7899F26145467AA2633603D64A1CC452DB5713FC2DA526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2