Extracted

• • Target
    da65ea0ec7c669f8313a750ee26a6d17ff74e96a47668cfc06e137f06ad02172
  • Size 45KB
  • SHA256 da65ea0ec7c669f8313a750ee26a6d17ff74e96a47668cfc06e137f06ad02172
  • MD5 30ac1bed0ecbbb70fb9d8faaa1d78b5f
  • SHA1 286a532237914e5473bf0c623e47d650fa3959bc
  • SHA512 0e7e505d941c16d7168175721a880d4dc91c252416345c9fcd96bf50c559dbc3df93e0867cade9cdd6bd92267b75eb1ed43099066d0490fec923cda73fe9e7ff
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAEuwZQaKkPIFzjbDgX3ieBhu9JOwk1dahIY48pEBs:UuKWgSJTwRf2oIF3bcXSP9wbdahI/oys
  • TLSH
    T1E8231A003BE9C13BF1BE4FB898F26145867AF6633603D54E2CC4519B5623FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2