Extracted

• • Target
    d430e785d86e4e0fa5ea28e44aefda87187884f3ba2e6f65bf8ee6baa2ea3890
  • Size 45KB
  • SHA256 d430e785d86e4e0fa5ea28e44aefda87187884f3ba2e6f65bf8ee6baa2ea3890
  • MD5 e37e3069d5eaed420ad9e4242dc1500e
  • SHA1 2b73d5090636c9b549f6d318f72e61ff9b68cdfd
  • SHA512 3e4cc8f30193ae6b085252e784aa760f370b9ca376065845494e21aa74462b61afd214c30df634b736c5bd519c0fd3c1204ae041d14bbb82818a4044aa619aea
  • SSDEEP 768:ruKQpTA8RXNWU5xFrmo2qre8V1RpPEcPIMzjb9gX3iaFrWiaNj+K5PnBDZ0x:ruKQpTAOX2z8VDZEhM3bqXSaHMj+Kfd2
  • TLSH
    T148232C003BE9C23BF2BE4F7899F26145867AF2632603D54A1CC4519B5623FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2