Extracted

• • Target
    d69307c20421bcfa57f02c979c009079dd9d1fd8fd10697c8f25e3abe72aa797
  • Size 45KB
  • SHA256 d69307c20421bcfa57f02c979c009079dd9d1fd8fd10697c8f25e3abe72aa797
  • MD5 e4cd1e90372ebb224ac527a5a770caed
  • SHA1 47c3f645b05cac53f8aa7d623343232c814610c7
  • SHA512 5770e82e931120a89e64f5b96546267731021a372cee031f16b696aad21cd30eba6c93bb32dd61aef5327c0ce24d662a83da88ca4aa281e14f589b5f2f0b0f12
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFg3Fo9EaOPIuzjbzgX3iYVy+BE1iBp3ETJBDZUx:cu7e5TH2A2R8Ea3u3bsXSYoHiP3ETXdW
  • TLSH
    T142232B003FE8822BF2BE4F7859F25145857AF5A36603D54A2CC402D75713FC6DA42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2