Extracted

• • Target
    293d6864c380b6c15b36a0002b3ef13341f5ea6bf583ee0c1f8186a0cc4475c0
  • Size 45KB
  • SHA256 293d6864c380b6c15b36a0002b3ef13341f5ea6bf583ee0c1f8186a0cc4475c0
  • MD5 b4f22fee1671df7c085aae3aefdf29e8
  • SHA1 4bfa4e16ecde697e142333b10a4430adc9b5ec5a
  • SHA512 ae8bef01d35a8b94a56a44f4cef08298afdc6115c5a2a8bccce4b8d78db3aff1619e0e3d9e7d20738da3fe0cb98fded363e8ecd26304965391ffa909a048b940
  • SSDEEP 768:wuDWZTpw7bmaWUg3gSk0mo2qlzfBohEa+PIvhjb2gX3iFy6RQWRMhhhOwIGBDZMx:wuDWZTpMZSB2S4EaHvxbpXS86RQWRq3a
  • TLSH
    T15D233B003BE8826BF2BE4F789CF26145867AF5637603D54E1CC411DB5613FC69A42AFA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2