Extracted

• • Target
    2165c3a8a4234406487b17adf11765c62500e7741ac5c43fd45f87913d63969f
  • Size 45KB
  • SHA256 2165c3a8a4234406487b17adf11765c62500e7741ac5c43fd45f87913d63969f
  • MD5 bfaf534b8d60bb3c0395bf6bb6bfcb41
  • SHA1 e44da84b9b97e90711730a904dfa41a99b8e5468
  • SHA512 32d779f82519b355009f0414b74f871f522438af3941848c5585a9d8df51c1b6234a70ec81faf6d91e785b110b0ec2e32f26ae25587bbd625b220c174d3494da
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q11Bz3QKx7PIUpGjb/gX3iYVvvVgKISby53WgBDZcx:RuxkJTgip2AV0UpqbIXSYVvyPW2dcx
  • TLSH
    T165232A003BD9812BF2BE4FB8A8F26145867AF2636603D54D6CC452DB5723BC5CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2