Extracted

• • Target
    0f57c1b9ba32bb6dbbec2bfd5f2d260a3c38455d20e4e9b56014d9a3acfa5aa7
  • Size 45KB
  • SHA256 0f57c1b9ba32bb6dbbec2bfd5f2d260a3c38455d20e4e9b56014d9a3acfa5aa7
  • MD5 d99a3268d6fa65317088cb6c0f7b6cea
  • SHA1 e859b7b9d795092dfc1b0fe36c8fd77a21d2c5f6
  • SHA512 97684a491504bd834834be13012c816fd989fb193955e2a38af2e8fbf45c9f03a70b65b6d311a87b1de9c911b8f649a458df20e8a7c075fa199b27b02c11c4d6
  • SSDEEP 768:QulCJTHESwgWUK3aGmo2q9BGFZQjB4PIFfzjbbgX3iyi2E0sMqvSVwq7IZBDZgx:QulCJTHl42FqF9Ff3bkXSyRE09q94OdS
  • TLSH
    T1F9231A003BE8812BF27E4F78ACF26145467AF6773603E6891CC451D75723FC69A426EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2