Extracted

• • Target
    d2b3559faacbf906c30308260130454e437f04155051ff19fa6d23df64511a57
  • Size 45KB
  • SHA256 d2b3559faacbf906c30308260130454e437f04155051ff19fa6d23df64511a57
  • MD5 cd4233f909490c2a48f84f6c0a8a4fba
  • SHA1 4f77bb999380e5274a370a6c9f985312c9189331
  • SHA512 2487a697ad4f76711910478508db2ec50913d9cc59112f6a7c0792c86fb9a980dcb64e1102e81c60ab4844ec2223c7dbf61a8e025660c855f772180eb9097083
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q9D9Y6kq/zNOPIyzjbhg63iIuYaKFIN7BNKvnBDZsx:EufspTf2g2Oa9C3y3bO6SIQ9KvBdsx
  • TLSH
    T1E52319003BE9C22BF2BE4F7899F26145467AB1633603D6491CC452DB5723FC68A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2