Extracted

• • Target
    0d809c867a2e94187183d52a56aa8dd112b2835e5ef3be7f73c6e85bfda3b399
  • Size 45KB
  • SHA256 0d809c867a2e94187183d52a56aa8dd112b2835e5ef3be7f73c6e85bfda3b399
  • MD5 256e5176e17623c24c9f318366b65656
  • SHA1 0390ac76fa3d76b27f16a9a3b30bf87fdede157d
  • SHA512 8e13a8c39517337aa266690810ba7bc10a1965dbf193b06196ac9e2545fc95bf4879696af3d2d3872e0c2097fd7ba0ae2a93bcf83bcb8f483dd797fc89c74b6f
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qln9xY6aZOOPIrzjb5gm3i+yxsJgFiBDZMx:wuDWZTpMZSB2Cs/O3r3bWmS+XJgKdMx
  • TLSH
    T17D231A003BE98127F2BE4FB898F26145467AF6B33603E54E1CC4519B5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2