Extracted

• • Target
    d6706fbce6deb730e5538568683219231e58831c00affb77d804e352f27bb32e
  • Size 45KB
  • SHA256 d6706fbce6deb730e5538568683219231e58831c00affb77d804e352f27bb32e
  • MD5 b2f3e40d90e13da9f66de1b3d0e6299c
  • SHA1 d24d2a227531f85c709d1c4216d02ef051a1bc13
  • SHA512 21302bb3416bbd57d03f0936ac50ab81ce7b45c86c2786bee3403b6957e09bd56603f00d89934b5ff02ffc220cb545e74c0e311ee66f5e9bef09809164f81a52
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwlm/9GgrOPIRzjbWgX3iBksqwucsUczBDZMx:ku40ZTXEb2xm1b3R3bJXSmtcdcVdMx
  • TLSH
    T137232A003BE8812BF2BE4F789CF26145867AF6736603D5491CC452DB4B13BC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2