Extracted

• • Target
    289249b08ac8a5d138bb02993e04f5db4ef8d4a4b99fb609ad0148f69bbd41d0
  • Size 45KB
  • SHA256 289249b08ac8a5d138bb02993e04f5db4ef8d4a4b99fb609ad0148f69bbd41d0
  • MD5 d2810ddd8369e741114cc63a72c22bd5
  • SHA1 70766421b619d4671a84f48b56d11be8c944af1a
  • SHA512 55496d55818f3354afdad40ededeb8f9403fa760e33b8d1cc45f506e1fcf64d8a723574cf44c06df3aa39dbd0d7785c3bce848f49cd874e0b44bf3e8f1b09c30
  • SSDEEP 768:8uUIpT4vvofWWUEXb+Imo2q4GoopCBK9INJPIZzjbJgX3ixvYKDzdDrdWOpXBDZ2:8uUIpT4vAj26o6bIwZ3bGXSDhJpRd0x
  • TLSH
    T10B233B0037E8C22BF2BE4F7859F26145867AF2637503E54E2CC4529B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2