Extracted

• • Target
    d865c686562ea8cf7d1f8432da792265bf710d2dde5749c9a9da7b46fdc42a77
  • Size 45KB
  • SHA256 d865c686562ea8cf7d1f8432da792265bf710d2dde5749c9a9da7b46fdc42a77
  • MD5 880d555303e15ee8d720893c90254d5d
  • SHA1 d9d84d311ab2883840764409cdc1b218ea23ea51
  • SHA512 dd4e1ee7fd8c62592f74cade585c4224a7f287fd4281e09fe67e26e30b304fa500086271e23dd6bfe5733d0d169494cce10a87a2cb8583786a9c36b3d1694da9
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVP/ycD3APIMzjb6gX3GuSWBf5VO0GxBDZkx:suJdpTPdI2eq+3lM3btX2jGhVO0GPdkx
  • TLSH
    T112232A003BE8C13AF2BE4F78A9F26106467AF2677603D64D1CC451DB5623FC69A426ED
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2