Extracted

• • Target
    c23bf0aeb91b97680f7dce2d7362d1d79ae21312219f0e100b9c03739c66cc26
  • Size 45KB
  • SHA256 c23bf0aeb91b97680f7dce2d7362d1d79ae21312219f0e100b9c03739c66cc26
  • MD5 e45655a5707b50b368778aa7bde46008
  • SHA1 3628bc7febb2e7819d91366bf6e1c8816668804c
  • SHA512 435c7dee5b539eef481f5f07b3585b27e98207d834aebacc78e77a5b073ef8d75489265eab70d2ad05a08a6a6e490634fd29d351b41c014bf73b7c3a81a4b8cf
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qA0wZQBKkPITzjbygX3i9IKB1/oHjK0xv17BDZcx:UuKWgSJTwRf27bT3b1XS9Zc2Qv1tdcx
  • TLSH
    T12C230A003BE8C23BF2BE4FB85DF26145867AF6632502D54D6CC4519B5623BC6CA426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2