Extracted

• • Target
    f682f375674cb4ed0116a73dae4ebcf40c51ec4116d5ff499845212dd3ef2dab
  • Size 45KB
  • SHA256 f682f375674cb4ed0116a73dae4ebcf40c51ec4116d5ff499845212dd3ef2dab
  • MD5 7c66e094ccdbd756fa9106eae33bf8b3
  • SHA1 d58f52a7f3482b1224344fd2cdbfb7d1d2167538
  • SHA512 10b800ba8dd297bba80280a6b6e7e1b8ee685380b0611b886779a1287b0bbb25dada2db0a56311de1895c69001a1fd5046bb3475dab32457bb27aca75e41ff83
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1nfkLyuObvtkjZPIuzjbVgXAi5gXS8bNKgg480BDZUx:cuR0JTPjY2OfLuyyjWu3byX9ai6w1EdW
  • TLSH
    T110233B0037E9812BF2BE4F78A8F25245867AF6737603D64A1CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2