Extracted

• • Target
    d43b5728594c6ca2631654d1a922ff1b0d4981e2b2d32f9c78677928d5af4730
  • Size 45KB
  • SHA256 d43b5728594c6ca2631654d1a922ff1b0d4981e2b2d32f9c78677928d5af4730
  • MD5 7fabfeafd5076e9b7b2cae887335bb5a
  • SHA1 294a6cbb147427b20d63fc20a9c6daf5a3053201
  • SHA512 367039c1208a282ce5ec700255c6d881a85c378c82649f51025d39e3820e8f530b3fc116df2a6838fdc8de47d2ba15a74c844fd1898521842b4c58c9fcbaca10
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1fL5P02FUFdxYkk8PIazjbggX3ineMOTZMp5z4rzBDg:cuR0JTPjY2SLDmWBa3bHXSneXNG5z4J0
  • TLSH
    T1FC231B0037E9C12BF2BE4B78A8F26145867BF6736603D64A1CC451DB5A13BC686436EE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2