Extracted

• • Target
    268c7930cd3d4185db461f2a099a735051a458be8b31b0c4d9e4f70eed63c2d2
  • Size 45KB
  • SHA256 268c7930cd3d4185db461f2a099a735051a458be8b31b0c4d9e4f70eed63c2d2
  • MD5 df3c6ff163668974d29756c6ee31bc37
  • SHA1 6f0c7d3946f1b940ae3e2d862b421177248969cc
  • SHA512 a3d239ce51dc90e54f2dcd71e5f642a9cc8a7d2ec18febbe4f1b3ced5651d1acc40ad06ee1b0570ce856910fcd2b9036721394461802802a1b03f53996899cb7
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFg3Xo5EayPIEzjbFgX3it9LvNnKrW719p2fBDZUx:cu7e5TH2A2LQEabE3bCXS7IrWspdUx
  • TLSH
    T1E5231C003BE8822BF2BE4F789CF26145867AF6636603D54E2CC451D75613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2