Extracted

• • Target
    1249fca2fb498af3aab6683aeeab3633e639a4a6160b9ea89cc2fe8e1c938627
  • Size 45KB
  • SHA256 1249fca2fb498af3aab6683aeeab3633e639a4a6160b9ea89cc2fe8e1c938627
  • MD5 4a66eabd735fde44183f39b4ca60b6a2
  • SHA1 a302987ca994554e7ae47984757ae6c674cf8f10
  • SHA512 97fc9eeb04d06d0bd3468ac3b1c16c1c389b28fab636a0ae11189e01b25a79cf873c14ab7ec5b77d4179b623534e8334bc07f979d8a3c2dda25769f2a122f929
  • SSDEEP 768:kuSOpTPTCFcWUeXa6mo2qAqqyx0OFUwdrxIkDPIOzjbQgX3ifXi+vdD8RBDZMx:kuSOpTPOP26qKTNMO3bXXSq+vdAvdMx
  • TLSH
    T192232A0037E9812BF2BE4F7869F26245867BF6733503D58A1CC441CB5A23BC59A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2