Extracted

• • Target
    28e1d02734975defaeab729355adfca01c0901e60b54abce085781e94281b0ef
  • Size 45KB
  • SHA256 28e1d02734975defaeab729355adfca01c0901e60b54abce085781e94281b0ef
  • MD5 8fb7eb016f268c74e67d2ac421520fad
  • SHA1 339808b1447a04bd2113bfc92e8f2ec1564c8586
  • SHA512 64781e18d592a164a44e1f9854c2275eba6a12eb0c45904029727d637c1eaaad1d44b38406e940256753e81451b85b0cb62ee60306e79410ed749654d0772810
  • SSDEEP 768:RuxkJTVmU5EkWUGMKSmo2q1umaPcl83APITpzjbegX3iLt5ZKNLUiWpqF3BDZcx:RuxkJTgip2PfcS3lTp3bhXSLnDpgxdcx
  • TLSH
    T1EF231B003BE9813BF2BE4F7899F26145867AF2636603D64D1CC451DB4B23BC69A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2