Extracted

• • Target
    d03ea5c4951a6acb126f94fa8928db56efd2808f49017a6b863fb8394423fcef
  • Size 45KB
  • SHA256 d03ea5c4951a6acb126f94fa8928db56efd2808f49017a6b863fb8394423fcef
  • MD5 7dad4c11cbffc9bab75b3adc13a74c5f
  • SHA1 d9e85b24df312515d06e6bd8c4e97fc78a513610
  • SHA512 663eb11201064943c6b972853cd9f67448473e61999d40c24497699fdc57db0a9d6574a361e113fedc3ea9c8ac56171ff48b0100b13dbcb588eacd4306b23fd8
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjQcQSCBznqNLPI7zjb5gX3icsslB0WhlBDZ8x:0u2vpTDe+2nc9UqC73bWXScssD3hrd8x
  • TLSH
    T165231A003BE8812AF2BE4F7899F26145467AF6633603E94D2CC451DB5713FC69A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2