Extracted

• • Target
    d970509b1ba938b717c1581989636c81030871e57e505fd5a99854c9869a0066
  • Size 45KB
  • SHA256 d970509b1ba938b717c1581989636c81030871e57e505fd5a99854c9869a0066
  • MD5 2b02d686df160adb2f530cfe814f310a
  • SHA1 3cf00fd3218ab5dde2043ea13d602e862b95c38a
  • SHA512 30bd63acd5d1ac0f7cc503d8ae2d7f16c2ad848f7cdc03bc8e2233c6bc7fe84363b0bc9b67992234cdcd29fdab931132dbef1a86df009ec4000abede5d50b63f
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtxW8aIXOPIKzjbZg23iESiMgV6ceOm0BDZ0x:5udApTNmU2tFu3K3b22SRQ6cexCd0x
  • TLSH
    T1AD230A0037E8822BF2BE4F7898F26245467EF6673603E6491CC4519B5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2