Extracted

• • Target
    caf32de2195fe3b36f3ebb7dba7f7b9bdf0e882ba684a2444f47942350c8822c
  • Size 45KB
  • SHA256 caf32de2195fe3b36f3ebb7dba7f7b9bdf0e882ba684a2444f47942350c8822c
  • MD5 7ae9bd7261a7ecd390e6c9e1f875e994
  • SHA1 2050d36ebe49fca572d720e16f265b4fd3fe265b
  • SHA512 271fe292dcc3f64f359cbca68ec08e25fd16691d82e2ac0478e17e3e8c3bc1c33359798fb711d4143583570222c9a03c176502899ef92f5eaf4f27cdfb078abc
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9DiD8yfzuOPIZzjb4gXvibPCPUN6lrLOZF4QqBDZsx:EufspTf2g2eiAJ3Z3bvXKDRCeuQ0dsx
  • TLSH
    T1AE233B003BE9812BF2BE5F78A9F26145467AF6633603D64A1CC451DB5713FC28A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2