Extracted

• • Target
    d005eed81822b62bb6fb1a9fbe31d328b1dba6388e4d8c556ae50ffc8a749c64
  • Size 45KB
  • SHA256 d005eed81822b62bb6fb1a9fbe31d328b1dba6388e4d8c556ae50ffc8a749c64
  • MD5 1c23b8d0313b1b6407e0c44ba969dbf2
  • SHA1 1cb542505765168c188e507c5ef7c0768cdc803a
  • SHA512 732e33753451fd694a782f8a7b9c697479d0132249243e1d06137b8d2d6668a2c8a44b8ff402c2607d77639be1b74e3e4222f4dc6dd85302d9d5067e4e73099c
  • SSDEEP 768:wuZ8pT1Uu4/cWUeT66mo2q1nLiE0yFjrdjYkk8PIubjbugX3ilhJkydyBDZMx:wuZ8pT1tc2KLBXQBuPbRXSl/kWMdMx
  • TLSH
    T191231B0037E8812BF6BE4F78ACF26245867AF6732603D5491CC451DB5623BC68A436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2