Extracted

• • Target
    273c8d574c3c55ca0ce21a3d3ab93fec60fe3524f2bcf80e6fc7c57fcedb013e
  • Size 45KB
  • SHA256 273c8d574c3c55ca0ce21a3d3ab93fec60fe3524f2bcf80e6fc7c57fcedb013e
  • MD5 57e821b864ff732a4351ea9594120275
  • SHA1 1dc73a4560809d441aadab69b70f5b5d99e82940
  • SHA512 c9ff7ce8c124fda61765c62ff3661b73ca9ac5b1d55e8d1a7cceee06a05c65e467b741e243d654030a468149a01a4713fc30a81ef39d6d35aeb9da500909cea4
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlLlsHoPEaMPI1zjbwgX3iSo7RR/ajBDZMx:wuDWZTpMZSB2OuuEax13b3XSrX/+dMx
  • TLSH
    T185232A003FE9822BF2BE4F789CF26145857AF2777603D58A1CC441975613BC69A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2