Extracted

• • Target
    0d0dc15adce01d4a146eed0db4b4c850cec32731fdd23bd3760a3446a8407bd3
  • Size 45KB
  • SHA256 0d0dc15adce01d4a146eed0db4b4c850cec32731fdd23bd3760a3446a8407bd3
  • MD5 ae5e1d9cf06ea34b4a8c965124f660c1
  • SHA1 5c4277f16ab2afd9789f3170b9c8fd434bb4895c
  • SHA512 7023540f19b8aeb5a02af14216bca4e14363d6862ee4a942f20e54999aacae8bad9f8677c3481137cd662dcef72dc5bb667c340361aae479722fc8e1ea1d577d
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFJhk6c7OOPInzjbtgW3iM2XKw14U69AJDi0c7niBDg:cu7e5TH2A2w6TO3n3b6WSH9U9ELzdUx
  • TLSH
    T187233A003BEC822BF2BE4F7899F26145467AF2637603D58A1CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2