Extracted

• • Target
    233e297c8602c77665f673989f424ec85057d4ca1dca9662f80c0241022f4ef8
  • Size 45KB
  • SHA256 233e297c8602c77665f673989f424ec85057d4ca1dca9662f80c0241022f4ef8
  • MD5 06bd4ceb5b5daa2c7cb6830cb73b7688
  • SHA1 260115d278530cf5a86e8cbf348015faaa9d0bc2
  • SHA512 ea0e6554f08f8eb3139857eb114ec00cc2b4413f40b9d66542861585532c207593d0f61fcbfa08622172a77a0c91790c53f96be802f137e6805703d1d595c8fa
  • SSDEEP 768:0u2vpTD4U2ieWUsqfAmo2qjLS7synzuOPIzzjbfgXIiEswj6BDZ8x:0u2vpTDe+2gSYh3z3boXFE/kd8x
  • TLSH
    T172233A003BE8812BF2BE4F7899F26141867AF6632603D64E1CC451DB5713FC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2