Extracted

• • Target
    d4a386c7b60f4cb88ee15ea6b9d3add469e7878aa64a65603a5b01362b5297ff
  • Size 45KB
  • SHA256 d4a386c7b60f4cb88ee15ea6b9d3add469e7878aa64a65603a5b01362b5297ff
  • MD5 ee8ffaa3b53b3f0bb6566446d6b40ddc
  • SHA1 1eb3f8225b72012ecdd3779043475fc5fc89e7d3
  • SHA512 7dda4c8d5533a33fcb6c826c770bb7e261c774559527aaa431d5518ff2b0e62852dd7717130af00ea7bf43c95066141ce7991c8d3fe45fb9090036d56d3ad2d8
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1N8V1RpPEcPIMzjb3gX3i90NGUhoaOmXOIOBDZUx:cuR0JTPjY2+8VDZEhM3bQXSEHrNXOIA0
  • TLSH
    T1EF232A003BE9822BF2BE5FB86CF26145867AE1632603D54A1CC451DB5613FC6DA42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2