Extracted

• • Target
    29d5a200c8bc51a97cb4e2b8cf898c4fe061685c51cda6e8bae921bb4c244df0
  • Size 45KB
  • SHA256 29d5a200c8bc51a97cb4e2b8cf898c4fe061685c51cda6e8bae921bb4c244df0
  • MD5 9edb51f3f59f6f0e3c5ba77e39d29761
  • SHA1 d39117ee9e418661cfd681a8e613e0d49b7b9609
  • SHA512 988fb2fe65260aa770e60a6ee2a690df7dbfda7775b11fa32194065bb85ae346b6673c3fffafbf68b4879be163f01c250a41b64462474246e0db605eb693b145
  • SSDEEP 768:ku40ZTX3uXTaWUgzW0mo2qwlm/9GgrOPIRzjbKgX3iU6i2zTcsPePBBDZMx:ku40ZTXEb2xm1b3R3bdXSxiMooEdMx
  • TLSH
    T1EC231A003BE8812BF2BE4F789DF26245857AB5B72603D58A1CC451DB4613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2