Extracted

• • Target
    925dd28fa6e12de7209949d9a54ef5f9d2eb71c6bd24a3cfd0f57990dd36da2b
  • Size 45KB
  • SHA256 925dd28fa6e12de7209949d9a54ef5f9d2eb71c6bd24a3cfd0f57990dd36da2b
  • MD5 32465dba808ff4917b858e69b5a7a1c9
  • SHA1 86dbf569a8fd6b678ccd814c27190e4663abf08a
  • SHA512 68bca58501adfacdc226f26faf28686ab80c289f45f7be59019979b1dae73ac09f66adc92d6489efee0be3aa1d52d657145e924b29394e713dd4d8e6cf91422c
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV3xY6AZOOPILzjbggD3iMPtEGLrXQBDZUx:cu7e5TH2A2kulO3L3bHDSMq22dUx
  • TLSH
    T171231B003BE8822BF2BE4F786CF26145867AF6677603D5491CC4519B5A23FC6CA426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2