Extracted

• • Target
    266e9238b45f69f7692ba2cf5064a79926f7af0d9381e5f57f039d59cb2bda23
  • Size 45KB
  • SHA256 266e9238b45f69f7692ba2cf5064a79926f7af0d9381e5f57f039d59cb2bda23
  • MD5 dc15852ddddeba4db11daa09e3127f47
  • SHA1 4a5f7f5d912b7d3e75684f5c4b242807446889a7
  • SHA512 81d9bec2c6004e9931614290f2f0399b7a81ede4156e5ab22715690e5ada1db1fdf5682c176d6514e1cd7c139fc36a8c3963685def557bc5734f344d2c74e237
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1/qyx0OFUwdrxIkDPIezjb4gX3iEYfiufxBDZUx:cuR0JTPjY2CqKTNMe3bvXSxaidUx
  • TLSH
    T1B6230A0037E8812BF2BE4F74A9F26245867AF6633603D6491CC451DB5B13BC69A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2