Extracted

• • Target
    294a9860f4a39d43cc0070c13cb05f433a341a7255644b2402ad211eb5aa5d2b
  • Size 45KB
  • SHA256 294a9860f4a39d43cc0070c13cb05f433a341a7255644b2402ad211eb5aa5d2b
  • MD5 76126697bfc6dc5c255b00cb5ca8c6eb
  • SHA1 c1e693d46a8c5660ab5386707d4d0a22f3b73859
  • SHA512 0d2e4a8445e463fb4a148a7cc68d9a5313083bb87f2bb8f9bd737e8caf347640dc0047e4eb6756a357cd4b33328653483f4d7d253204d2947f4fec867a708337
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVT/qpG3jHuPIszjbHgXMiT62p8UBYrKgwqnBDZkx:suJdpTPdI2WIM3s3bAXp2NKx+dkx
  • TLSH
    T1C92329003BE8812BF27E5F78A8F22145467AF5637603D64E1CC452DB5723FC69A426EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2