Extracted

• • Target
    d4ae23c4fe5004dc47849a5b18e2d0b324e1c91ecebf82d4c5fb90b623535458
  • Size 45KB
  • SHA256 d4ae23c4fe5004dc47849a5b18e2d0b324e1c91ecebf82d4c5fb90b623535458
  • MD5 fca55d118ed154eed7d9e26293f30134
  • SHA1 a0a00a551088f999dfc7c987317d3ceb5327e776
  • SHA512 c372ece2d0780e6cd973b0daceca31d7890a29611fd6272899a0245116531d5837a1b9371f9436556ab64bd5639d05f3664c0dcbb4b286e202d3e1884c435ba3
  • SSDEEP 768:vuogpT78XvEsWUOsRzqmo2qrXT9Qpm9PI8zjbWgX3idQR1KNNCvhBDZkx:vuogpT7I62AQ83bJXSCR12C3dkx
  • TLSH
    T13A231B003BE9813BF2BE4FB898F26145867AF5632603D64D2CC451DB5623BC6DA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2