Extracted

• • Target
    012ed1d9d545a8e361e0dd34f023342320d5c351537c8625e5678a0425847f92
  • Size 45KB
  • SHA256 012ed1d9d545a8e361e0dd34f023342320d5c351537c8625e5678a0425847f92
  • MD5 0dca72a3fcd518f196f0e75ff20e3404
  • SHA1 f80ea409e23141b6096a0145a035f2cfbc17a96b
  • SHA512 99a5242dc0fd4be44f0455dabdb735483160f65b06acadd05bb02aae7e6639e3fa396287666f8f182785415dbe2fef1b64524068ca69b4391ee74be6148b8118
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjD9oSsqHz1OPIqzjbPg1k3iQ0I8rNcCL7I6BDZ8x:0u2vpTDe+2YKti3q3b4WSQ0I7CLzd8x
  • TLSH
    T1E7233B003BE9C12BF2BE5F789DF26146867AF6633603D54A1CC4529B1613FC58A426FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2