Extracted

• • Target
    c10f420fbe9e48ead561a28fe8b272061a0e1926ed7697d63e0424d25b7ab654
  • Size 45KB
  • SHA256 c10f420fbe9e48ead561a28fe8b272061a0e1926ed7697d63e0424d25b7ab654
  • MD5 9757fe7209d7dd243a2554618165f799
  • SHA1 5a0c9a32cb38a92f46047028ae84b6eed729304e
  • SHA512 47e4b99351aac62c541dfe98c5ebec98f3c271d6c8e5847669bb37fb71cb4e4bdaab5f7f0dc21cd9ec22e1066b3b5a48c05653dddf6d217cfdcd153f2e9dd1f4
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlneeXK5oibbb6TN8/nPI6WzjbwgX3i0R45i8Cae7:wuDWZTpMZSB2DeEqTNKA6W3b3XS0q+77
  • TLSH
    T177231A003BEC812BF2BE4FB899F26145867AF2673603D58A1CC451DB5713FC68652AED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2