Extracted

• • Target
    0db971ca034207019052eeafce9df2a4ce2ac5e555132fb7d782773a5d5f89f6
  • Size 45KB
  • SHA256 0db971ca034207019052eeafce9df2a4ce2ac5e555132fb7d782773a5d5f89f6
  • MD5 94020a51cb203f7fa6e0d9c5a0aaca2a
  • SHA1 85d07f5b5063ccb7dcbfa1c8ee10815c4c86a04e
  • SHA512 95b8f32a7c795b5333bfcc14f957196173159a9b0d8350bbcc3b9b46310975f8147a0961430b09abd4928ef9235295366b6e403b899c74d8a455ee52c93f2eac
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9TZo3TMtPImmjb9gX3it/iY2UJv1iZyBDZsx:EulCJTHl42sU3mKbqXStKkjiZMdsx
  • TLSH
    T144231B0037E8812BF2BE4B7899F26145867AF6773603D58E2CC4519B5613FC68A427FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2