Extracted

• • Target
    0f2554a86bc3cab43158db0ab02973fa0440504342a4209b43904e76ea4bcffd
  • Size 45KB
  • SHA256 0f2554a86bc3cab43158db0ab02973fa0440504342a4209b43904e76ea4bcffd
  • MD5 f380cc6315cd888a5989eac0badae726
  • SHA1 233186921ed6ae5c433a4f204edf679e6482138b
  • SHA512 0bce208a47c00a0ec58a704d212b7d5ec7fa8b103b0fb8e2f6ab3e57316c4beea31d8e9c4b906644cbd08e1dedfad3c63336a2c42d2ecf23ca2d40e39033ad44
  • SSDEEP 768:Iuq04JTLcsP8EWUmOTymo2qAMsD/pneqPIkzjbMgX3iwblS9tC+wiCdBDZox:IuqNJTLr62csjJeTk3bDXS6lS9I+fCz
  • TLSH
    T104231B003BE9812BF2BE4F7898F26145867AF6633603D58A2CC451DB5613FC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2