Extracted

• • Target
    549f24013d35da8d9ac5e14e81b1ad505ce33ff9e05d1a61018ad2a20443b780
  • Size 45KB
  • SHA256 549f24013d35da8d9ac5e14e81b1ad505ce33ff9e05d1a61018ad2a20443b780
  • MD5 cd04b6b5a5a21229f242ec678de26bb8
  • SHA1 006f5a3269358dd85af5ae0ccc875cada69026ab
  • SHA512 d859e1a44ab234dfe074304b8a3d3a4005953b45abd85d909f84665c7ccf7b95c9d295f1bfe082c447840c33ef1e389c9ff315e765e392b856d38fb8c6046474
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAOGsGx8OHuPI2zjbkgF3ifRBoN+hkNOBDZcx:UuKWgSJTwRf2eez323brFSf3oeKAdcx
  • TLSH
    T1C3232A003BE8C12BF2BE5F78A8F26145857AF2637603D5492CC452DB5623FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2