Extracted

• • Target
    279537fde8f41ec6d4492bf5034ab97316acda85e8e4e95081517192585fa1a9
  • Size 45KB
  • SHA256 279537fde8f41ec6d4492bf5034ab97316acda85e8e4e95081517192585fa1a9
  • MD5 c46946ab44745f9320754320f96ffc95
  • SHA1 b35356d7679c81c59071309d0b42780c071d76f6
  • SHA512 e3b526f02dd29cf79ec641fe05cd97a859a602696845a3b74868a70ec0ee8ba32616468efda9568844d9133f5570b64df4a7370cf51e9666bf0867eefa0ec26d
  • SSDEEP 768:MuBGJTP0BQ0UWUWHaimo2qVJpt0CCM+d4CvS8PIkMjbLgX3i1qEFCs9ldgqJlj6w:MuBGJTPho2Q/CFWBk8b0XS+EdgqljYdG
  • TLSH
    T1C9232B003BE9812BF6BE4B78ACF26245867AF5633603D64A1CC451DB5713BC686436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2