Extracted

• • Target
    22ffda8e65cd627378e6656285dba09f4f606ce060e45934abf2bd69aceccdf5
  • Size 45KB
  • SHA256 22ffda8e65cd627378e6656285dba09f4f606ce060e45934abf2bd69aceccdf5
  • MD5 8127754d7c62322044c4c4cf26443ed3
  • SHA1 daa17ca33097a419577cbca3f0ebe30bf1c5a903
  • SHA512 a920aacfa63e8e85354128e7f683e27460c6020a95d0b8a0003d44c71818613251899333ac492bbd1c53dd6f2b0a166b2218e53b1e9b2c7abecf692bc28e5454
  • SSDEEP 768:EulCJTHESwgWUK3aGmo2q9nDEbHBqjSOPI/XzzjbOgX3ixTWE7z3gSr5/5BDZsx:EulCJTHl42IyoO3/Xz3bxXSxTxrBdsx
  • TLSH
    T137232A003BE9C12BF2BE5F7899F26105867AF6633603D5491CC441DB5723FC69A42AEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2