Extracted

• • Target
    dfe4caf97de5b0524012b26cf0d4808549f9786a5d8a4577e9c4b54248c9591a
  • Size 45KB
  • SHA256 dfe4caf97de5b0524012b26cf0d4808549f9786a5d8a4577e9c4b54248c9591a
  • MD5 11f41b3973f7dac30b69fd24c87c1294
  • SHA1 f42df04220e0d33538fbc48d8100bf05c058a58a
  • SHA512 ea631f4cfb12a94226fde7d5fd8cd8cfdc84d9f23e656a14a4a04d2604f127078b447285a17fffd70e831825ec681588ef947efd2b643fcd1bcb2a99d4fa748a
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVRwZQBKkPISzjbZgX3iyf4Brb2BDZkx:suJdpTPdI2TbS3b2XSyvdkx
  • TLSH
    T1D4232B003BE8813BF2BE4F78A8F26145467AF6636603D54D2CC451DB5B23BC6DA426F9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2