Extracted

• • Target
    dc116f417bc1e54012c4b3ddd29eb94e5f3bc8ea2ab1ec0ef89b13cdd2dd1c25
  • Size 45KB
  • SHA256 dc116f417bc1e54012c4b3ddd29eb94e5f3bc8ea2ab1ec0ef89b13cdd2dd1c25
  • MD5 7407a4484a43da17fa3538226a34c36f
  • SHA1 d45ab4380b00bfccca4b60ee718f858f330db0c7
  • SHA512 302d80da8ddbd07de0534efee514d9fd1930ae27af688e3bedea2c1799ee9e5ca74d4060ee3db0a5832645c72c994e62d15f44628b84f4f67c366ffc06f1ac05
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9LG1HJhOPIcEzjbYg93iu/vxzKsQPnWSAPBDZsx:EulCJTHl42fFj3cE3bP9Scp5dsx
  • TLSH
    T198233C0037E8C12BF2BE4F7899F22145867EF6637603D68E1CC4519B5613FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2