Extracted

• • Target
    dc667222b8fda4433c8da26339be428edee14e607aef408530fabb9a847fee4a
  • Size 45KB
  • SHA256 dc667222b8fda4433c8da26339be428edee14e607aef408530fabb9a847fee4a
  • MD5 514d5b22eaff0d52ac08d707c757d62d
  • SHA1 e9d9979d5e6c132231096c4e609fcfcd37e5dc31
  • SHA512 8428d53cb6c482040a4e04a4a65270970c6e4a0504b810dbb6627285d115da91ebc89649a87d6d9e66576fe287cfb0e4cab9a4a8d8958b1bc8b92b15f1d082f6
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1a10Bnjbc/nhfPICzjb2gX3ipIimTvsRctUqABDZMx:wuZ8pT1tc2n2n3A4C3bpXS2dTQcUdMx
  • TLSH
    T15F23190037E9812BF6BE4F7899F26145867AF1732603D54A1CC451DB4613BC68A43AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2