Extracted

• • Target
    294c22dc0f8cd2f8226a9dad775a1dde2afda66000954d4ba05620b39c75e841
  • Size 45KB
  • SHA256 294c22dc0f8cd2f8226a9dad775a1dde2afda66000954d4ba05620b39c75e841
  • MD5 ab6d66a09d61d73b5583b97470b7e6e7
  • SHA1 61b4c99fefccd2698225109cd001850887a0a557
  • SHA512 02dbac7310429433ee3b0ebfb422821ca85d6f69ea73dba3c76a00ff82fe59ca7d75df9f2ac813e6dc90f469e39d7a3f7fdc244b61f70368c680e1a51934cccc
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9b9YikqHztOPIUzjb5gi3idhf6ktEQHyDRdMWBDZsx:EufspTf2g2WalK3U3bWiSz6t9Ry4dsx
  • TLSH
    T166233A003BE9C12BF2BE9F789DF26145467AF2633603D64A1CC451DB5623FC29A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2