Extracted

• • Target
    deef47cf77de698feee2d68bd2b4b759d85f820cf09fa10e6e04f7ef3e048b4f
  • Size 45KB
  • SHA256 deef47cf77de698feee2d68bd2b4b759d85f820cf09fa10e6e04f7ef3e048b4f
  • MD5 379a945a745ab82f888588bf58c1b85a
  • SHA1 cd68fe1a88334e869a5de1377c75a3a4cd0dab4e
  • SHA512 ea3c6d92d7cf954a8ed30fdaf62159c7aa5de97d9ab224972648cb7a0c90bbc2e744046f4f2195afdfc998936f8d51c8835278155861c55b79178e169bd5e8ea
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVtBzwQ/x7PIPXjbmgX3ij2Hj6ANohTW3BDZkx:suJdpTPdI2IaFPzb5XSyD6koQxdkx
  • TLSH
    T188231A003BE8823AF2BF4F7899F26145867AF6633603D64D2CC451DB5713BC6DA426E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2