Extracted

• • Target
    db10ddfa60c11ab2027f1e7810c064c13d8bba42662a447c79d1b82c0166e62a
  • Size 45KB
  • SHA256 db10ddfa60c11ab2027f1e7810c064c13d8bba42662a447c79d1b82c0166e62a
  • MD5 73a485507c17b45acc77d3098d626b95
  • SHA1 5edb7f71b410e0f933e66242d2ba86ac2b0ef9de
  • SHA512 1d860c6e362bb82f67e704cf68f0bc1887f5567cf9f0aac77f573c96345c619641fdd73ea87182fb36c83a648dfb7e2d6cb478261576551cd4499d3f5a023b13
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9ORzMwnOPIZzjbIgX3iexOm8MTokE1/bBDZsx:EulCJTHl42PA+3Z3bfXSc38MTG1/Ndsx
  • TLSH
    T1FF232B003BE8C12BF2BE4F74A9F26145867EF6632603D58A1CC451DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2