Extracted

• • Target
    dc275786e4ddc603c37844214ada5810b4d91b13176c74f13ba120b5f04a81b8
  • Size 45KB
  • SHA256 dc275786e4ddc603c37844214ada5810b4d91b13176c74f13ba120b5f04a81b8
  • MD5 3443547bbe9fe16f910a53d059f057dd
  • SHA1 242150adecbf9770dd8632b247e7c097b8960e31
  • SHA512 293db344ffb3c9f5240e7fde95e5fca69618dd1ecd70f2bffde8331b8e64c2e70bd6e3f3ce2bbd2ef7a7f0f8dc3081be07ad66558c8c3a2883fb28c41ca9f15a
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98wD/y/aqPIpzjbGgX3ieRmH2oCqlZgBDZsx:EufspTf2g23khp3bZXSYPMlZ2dsx
  • TLSH
    T1F4232C0037E9C12BF2BE5F7899F26145467AF6633A03D54E1CC411DB5613BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2