Extracted

• • Target
    dc029d5d09aefe6fdfddbc3663eeed0a712cc85a171ecdc67b76c9a2bd03910e
  • Size 45KB
  • SHA256 dc029d5d09aefe6fdfddbc3663eeed0a712cc85a171ecdc67b76c9a2bd03910e
  • MD5 3dba34d02e9d8c230934635ec1ade7d5
  • SHA1 3c5629c38f3b81862e4d639d623ccc259988f132
  • SHA512 cdf7874cc56e6903ab8b6fc0efed2243d9a327e0ebe8d30afd7e2ef6f960ea20ead440523f08ff9aa4d786e7418ab274551a1cccf63c33ab8150e0afb4eb0421
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1nfPLyiObvtkjZPIrzjb8gXFi3I12T6+NLKDBWuJDLq:cuR0JTPjY2Of2iyyjWr3bTXU9reBFdUx
  • TLSH
    T134232A0037E9812BF2BE4F78A9F26145467AF6633603D64A1CC441DB5613FC6DA42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2