Extracted

• • Target
    db21994dc78f88e0f167d3337726a19ba5012978ba65c4da4267dcc395fc33c6
  • Size 45KB
  • SHA256 db21994dc78f88e0f167d3337726a19ba5012978ba65c4da4267dcc395fc33c6
  • MD5 895d17f489668042316ee62d37c58944
  • SHA1 5d357db051c87e386a79dcb30d967f24db0a2418
  • SHA512 b15f9effff9b32b2c652041eb3a46ed5ccf2d2b7a2de18eaeee67e581d1bf8d5d0813ed8898215e171918c4af27a4938a996351d444ab024d322902cd81e3d5d
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qN9O5QPCBjPSNjPI/zjbvgX3ifaALGi+rQcB15oJSo:5uSy6pTpoo2MO5sMSK/3bYXSyALGocB2
  • TLSH
    T158233C003BE9822BF2BF4F7899F22145867AF6673503E5491CC451DB4713FC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2