Extracted

• • Target
    daaddb0c6e5f2235e81b8a3ef0b584661dfe07c97eba57076f691cc16bf2e704
  • Size 45KB
  • SHA256 daaddb0c6e5f2235e81b8a3ef0b584661dfe07c97eba57076f691cc16bf2e704
  • MD5 39432ad0f9e3edd361d0bc69533a8bee
  • SHA1 493eff0de90182997867ce2e4e3afcf7cfc37cc9
  • SHA512 b6dfd0cc2afec4653b841963eb842d266e5ec6d05aba758e7047df8f3bdc3d4c174f250732ab6d5053b60db72ea5443baa88424c7688d6c2fabbddb8cdf22fd1
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlh+eXE8ofVl8NnPIUmzjbXgX3BMl0DBDZMx:wuDWZTpMZSB2pebGVl4AUm3bwXxMSdMx
  • TLSH
    T173231B003BE8C22BF2BE4F7899F26145867AF5633603D54E1CC4519A5723FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2