Extracted

• • Target
    4230026cf03766bf0e86285d8f766f87296dc3bfe0a195abfc98165cadd93005
  • Size 45KB
  • SHA256 4230026cf03766bf0e86285d8f766f87296dc3bfe0a195abfc98165cadd93005
  • MD5 e5fb35500ba82798e7b5aa5703c37ee5
  • SHA1 f7794fab3137c3fa69cb35134d1ea24bd2f2ca30
  • SHA512 666b2876eacc6f4e1edb545d0b1d7c2e0d1c5322caa58c050b2808aeb6a922c179b1693792020776f070b01b23486cfa98715f1c25e0e7e26b35591b2446a09b
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q15wZQBKkPI/zjbSgX3iXN++bFuBvBDZcx:RuxkJTgip2bb/3bVXS9+cu3dcx
  • TLSH
    T1B2232C0037E9823BF2BE4FB8ACF26145457AF2632603D54D6CC451DB5623BC69A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2