Extracted

• • Target
    2960d9c87b0e0c81275628a0188d36c0e8489ad7d7774f092065852ba13085dc
  • Size 45KB
  • SHA256 2960d9c87b0e0c81275628a0188d36c0e8489ad7d7774f092065852ba13085dc
  • MD5 1af26f156b864566082c6679d5bf5697
  • SHA1 a648be19931767b8bbcfd272bf1d66ec5ea8cf51
  • SHA512 66ee503d0f7a02b2f1c7db9eef96c47f33bc75a1ea62a271318561aa3c5cc5a0daaac3c852d1f1f6048306a871710fd78a55ec2bba36b3375b1e4e847accaf4c
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtm/rLzlJAOPIc6zjblgXqiB9Lk0oLQLCcJBDZ0x:5udApTNmU2ZPp23c63biXTrk0osdd0x
  • TLSH
    T1B9232C0037E8822BF2BE4F789CF26145467AF6673603D68A1CC451DB5613FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2