Extracted

• • Target
    d1356f3d799d4fcf36c2e5fb6703a8695f0d2b166eda7416f104ae534790498f
  • Size 45KB
  • SHA256 d1356f3d799d4fcf36c2e5fb6703a8695f0d2b166eda7416f104ae534790498f
  • MD5 af9e2db942228701f971fe82cc61a376
  • SHA1 e535a700f50d62ff5a542167ba989112c119a917
  • SHA512 d0d146779f81c1fc4524853e4fa5690fdc1fe9c8de751c8afbae91e0cbeb42428bb39c8799da6395de6c09dcb8fc127d821057e076385ec7c545340bd7496386
  • SSDEEP 768:UuKWgSJTwU6NkWUGnaSmo2qAe/qpG3jHuPIszjb4gXfiBuse3sJ7f/8/pGKBDZcx:UuKWgSJTwRf2OIM3s3bvXaisJ7f0hGUs
  • TLSH
    T1B3232A003BE9C22BF2BE4FB86CF26205867AF6637603D5491CC451DB5623BC59A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2