Extracted

• • Target
    de5545180560107cfde3163676ac06d162f10f22d47fd076630736295c0d2446
  • Size 45KB
  • SHA256 de5545180560107cfde3163676ac06d162f10f22d47fd076630736295c0d2446
  • MD5 e1b19323a3b7185c83c47c3261a2cba3
  • SHA1 9b95bc1a32973a782c076362b61af0e832d2fd8e
  • SHA512 29a712949d971b520a94606399277d5c1a79388ab6f5cfa99e757119b7c5353e091d074d25c8673be8e30e821238ccbc45db3541a3eadec5c15980516b10a0e3
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlI3Xo5EayPIrzjbigX3is6cIKq2K5z1j//eBDZMx:wuDWZTpMZSB2jQEabr3bFXSlz3Nzd/w8
  • TLSH
    T133231A003BE8C22BF2BE4F78ACF26145867AF6636603D54D1CC451DB5613FC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2