Extracted

• • Target
    0e272c46f1ba55e3bbe3f65872c4c61d347489f70a178ef723357782311f5ce7
  • Size 45KB
  • SHA256 0e272c46f1ba55e3bbe3f65872c4c61d347489f70a178ef723357782311f5ce7
  • MD5 9009f58461d10303682f001328a543ee
  • SHA1 dd17002017b984a316c5126f951b680e9ef9303f
  • SHA512 c95a5b0700337c3ec26070990b7c30a44cfcbda34e809ee2b02bd2506a8226d1b8c159d13474230c9cd5500561c4e59cb21d23abb61db57f8f3f8bbc16c508db
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlKm/9GgrOPIRzjbWgX3irOjhHCTz+0aLLBDZMx:wuDWZTpMZSB2Bm1b3R3bJXS8Wi0aZdMx
  • TLSH
    T19E232C003BE9822BF2BE8F789DF26105467AF6B33603D5491CC4519B5A13FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2