Extracted

• • Target
    ddfe5b2240ad8494c0a3da69c6f67719731fab99611acff3891cf077d118a6ce
  • Size 45KB
  • SHA256 ddfe5b2240ad8494c0a3da69c6f67719731fab99611acff3891cf077d118a6ce
  • MD5 f9c1474aad513a12606f5e982be5580b
  • SHA1 c375ffc2fe9731b9e45bbd2ca30c190be649d5b7
  • SHA512 8a6cb2993674a978b0beb89490592a9538abe9ba3fca8a9070de99bd418d9c0e296b734747e1cf696a106daef2d9e3250895c6f89ab347d94a3c1a62119cfc2d
  • SSDEEP 768:4uBfJTMUyYUWUWBDimo2qV38kLyuObvtkjZPICzjbugXRiWECBZX4wODIBDZbx:4uBfJTMpv2+8LuyyjWC3bRXAlSX4wODi
  • TLSH
    T15C232B003BE9C12BF2BE4F78ACF26145867AF2676603D5891CC451CB5613FC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2