Extracted

• • Target
    567f632d3025bd7aa2feb3e52be4a2286bf725c4a5b3464512536e5858d0a435
  • Size 45KB
  • SHA256 567f632d3025bd7aa2feb3e52be4a2286bf725c4a5b3464512536e5858d0a435
  • MD5 07094b6f60517eeabfb2e10fd69ba0c9
  • SHA1 1fc7d0dc50482611a631e3af4a1dccc8577e0748
  • SHA512 afdae5a0f2aa5fb75bfeb69e39fc135d8475d4f9a6a04f0c5c130834810526ef78fc3a38d01946d4b91b71cf5696a3ed3cee223d6eb98ab528d9f9984a84507b
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1S8V1QpfEcPIYzjbPgX3iAY/hA04rExEBDZUx:cuR0JTPjY2J8ViBEhY3b4XS/ZF+JdUx
  • TLSH
    T157233B003BE9813BF2BE4F7898F26146867AF2672603E54D1CC451DB5623FC69642AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2