Extracted

• • Target
    25cadb860859d1b5c373d7ad49168a7c75ab78bcb088631d73e9c85eb1232834
  • Size 45KB
  • SHA256 25cadb860859d1b5c373d7ad49168a7c75ab78bcb088631d73e9c85eb1232834
  • MD5 9bf4e7be0996f1de598b2005ddd2660e
  • SHA1 a0512aca1bcef140df53784702cbb2b23704d746
  • SHA512 e5f24858b9b4d00617ee833e35d535fdd72d36365b29c8c8d1ec6be7dc36680c825f489c6c37b271d8938c7c52d5e1c6a160423f095c2e172b97c641d6e2aa15
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAjT2QAm7PI10jbRgX3i+xIv+1FZPdt1nBDZcx:UuKWgSJTwRf2GT1UbeXS6IG/RHdcx
  • TLSH
    T145231B003BE8813BF2BE5FB898F26145867BF5632603D5495CC451DB5B23BC6CA426EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2