Extracted

• • Target
    17b9b7d0dff6ac7ea752082b10c08b660565f3b627a8130b5569276a4dfb853d
  • Size 45KB
  • SHA256 17b9b7d0dff6ac7ea752082b10c08b660565f3b627a8130b5569276a4dfb853d
  • MD5 5769cf7911e3095d2e6700bed46c7620
  • SHA1 54a5aacc44940b52e08f145f378886ddd9cc0000
  • SHA512 a5bf81c39621f19fb777895950a5e55e9b38cd6fbad40fe17461c25e91354ab609986364ebc45b39f5cfa9bf6fa3022129bbf3d1bd4fd1cd04a620fbb8a6f98a
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1LT2QAm7PI13jb+gX3ikrkM0IGCNKABDZUx:cu6YepTPso2JT1TbBXSkrQQNKWdUx
  • TLSH
    T130231A003BE8812BF2BE4FB8A8F26145467AB5633603D64D2CC451DB5723FC696526EA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2