Extracted

• • Target
    27f829a127df5c41496cc47e2151c1169b6c2b90b1889d1a3776b684f3e6e4ea
  • Size 45KB
  • SHA256 27f829a127df5c41496cc47e2151c1169b6c2b90b1889d1a3776b684f3e6e4ea
  • MD5 c9f70ede8eeeb5bfe0c5ebd91a3deed4
  • SHA1 72ab2eda7e153c87e34efa30cd96272f0af832ac
  • SHA512 153c8dae3b8e18a9a5c21fc8d3eb3a8c9f4f6fdb66aa251df7b66d40a354ccf670a9fbbb8b78a6915d4e1a83dbf59cc3be7fb24f3ee88b7f9d88dc6b2fc93886
  • SSDEEP 768:4uLZZTUAoOSWUYZL8mo2qFLSAFcKoabbb4ZhM/RPIAEzjbMgX3iBliUL6sW8DCNi:4uLZZTUTn2gSAvQZh6OAE3bDXSmSYuui
  • TLSH
    T1FD232A003BE8822BF2BE4F78A9F26145867AF2637603D54E1CC451DB5713BC68652AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2