Extracted

• • Target
    de3bc3d6904c2582cdd565ed5020e58de598ced4ba1c0e53b25f0cf393f39453
  • Size 45KB
  • SHA256 de3bc3d6904c2582cdd565ed5020e58de598ced4ba1c0e53b25f0cf393f39453
  • MD5 72e01f711e6661829bb3f98fd30a955b
  • SHA1 f1c62955020a51a2e7b81f58bba43369364d25af
  • SHA512 e92c745fd74697ccdb5c971067c413ed4d76585a9b7042441fcc527bc6106dfe0f90ae8a0c854354d061d2ad0b00b27360ddfc5e90190fa53d9176a802f329c0
  • SSDEEP 768:0uPrpT/LGKeWUszuAmo2q9K9YikqHztOPIUzjbTgc3iZLq/P06c+4OFQqBDZ8x:0uPrpT/qY23alK3U3bMcS4ETNORd8x
  • TLSH
    T149233B003BE8C12BF2BF4F7899F26105867AF6673603D64A1CC4519B5613FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2