Extracted

• • Target
    28a7bed21bd9b680e3470ed0e8f36361aabee91c3c0b34bd60e059febf15c81f
  • Size 45KB
  • SHA256 28a7bed21bd9b680e3470ed0e8f36361aabee91c3c0b34bd60e059febf15c81f
  • MD5 ab92b54614cf3c40cb8475904f0c171a
  • SHA1 e6be60744163e61614ed16167e59a32ca6a6bca0
  • SHA512 c597741748b2109de6e7e461e7ee6879955bf0f097a45b22d74bfcc479a0f6f63a77fe0e55b638fe7c5cce287539bd260875c0f6ff8f2cbae3d840bc1b191ee2
  • SSDEEP 768:QuflpT8AkKuWUch7wmo2q9dcQSCBznqNLPI7zjbTgX3iFUHS6Pw0FiUqegKBDZTx:QuflpT8Hv2sc9UqC73bMXSFiR0exdTx
  • TLSH
    T1CB233B003BE8812BF1BE4F7898F26245467AF6637603E58E1CC451DB5613FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2