Extracted

• • Target
    21e5bf136521964575750db53b10cd408622dedf7726be1b4522ba8cc5be179c
  • Size 45KB
  • SHA256 21e5bf136521964575750db53b10cd408622dedf7726be1b4522ba8cc5be179c
  • MD5 13845b354b89381b284e14902b1592ff
  • SHA1 0b829762c05d1d956ea49d84de7607fde7a0a537
  • SHA512 06d9e2f22144750a50ee3465373ebe0650bab93837a5fd3c083f015504141a6dc3323edf7c7ef5fa26c175b819dfe8f2ae349a9a667aac43d5dba947bf6219f1
  • SSDEEP 768:cu6RaepTPYzbs8WU+Xaamo2q1emaPol53APIkzjbkgX3inqPGA+oBDZUx:cu6YepTPso2vfob3lk3brXSqOA+OdUx
  • TLSH
    T1FA2329003BE8812BF2BE4F7899F26145867AF6637603D68D1CC451DB5623FC29A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2