Extracted

• • Target
    dd44a88256bd7e391e1e4dfe39199a6008a697076c4f33352803dd3d7606b24b
  • Size 45KB
  • SHA256 dd44a88256bd7e391e1e4dfe39199a6008a697076c4f33352803dd3d7606b24b
  • MD5 37d5829b0fae4f42bbd196d302757e74
  • SHA1 9114e00a900a6e05d632ef0c01ddc51cb53373f6
  • SHA512 2e7fdc080f9a514bc8c8533218d29967627f2e6e29721c8b9bc36946044e2c62d6f3abf5e7c18b498c50fa2f4a0a6159ffb557afd1a255c3a8192c3c32014c72
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9YQzPivMPIF4jbVgX3irYs7ILw0Eks+o4U4BDZsx:EufspTf2g28zMFwbyXSs9EZ8dsx
  • TLSH
    T128232B0037E9C12BF2BE5F789DF26145867AE6633A03D64A1CC4119B5713FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2