Extracted

• • Target
    d23645fe85e09346d1770e482a535e759a5999c30f8e84eec2cac96c8eb903f6
  • Size 45KB
  • SHA256 d23645fe85e09346d1770e482a535e759a5999c30f8e84eec2cac96c8eb903f6
  • MD5 ef250f8c5542e02bab9022470c7625dc
  • SHA1 263e00d2483ec15d382973ec36fba81bf12ae90f
  • SHA512 8cdd445653a6ae4c9bee453ddfce209f996a81d32b5134f02348d46b69c8d9e2690c6d8cdad9d643b7883563a34bdf47745c71fd7476f09e6b4652ad07f80e6c
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qVyqJaxjwHuPIPzjbngU3i6vYaK0w2jWrIZvyBDZkx:suJdpTPdI2H3+3P3bgUS6QR0bWkCdkx
  • TLSH
    T18B232B003BE8812BF2BF4FB898F26145867AF6637603D54D2CC452DB5623BC58A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2