Extracted

• • Target
    dd6af368eb7eb3ac9841ca085232d24d71556546f5fef72e3979e9f7422ea1af
  • Size 45KB
  • SHA256 dd6af368eb7eb3ac9841ca085232d24d71556546f5fef72e3979e9f7422ea1af
  • MD5 5fd1fb8cf96cf64964af9c07a6f96584
  • SHA1 683bd420b910ab59e59855e2a1a578304b84bab4
  • SHA512 aae84ce51a851250959461e8a0831cb617e50dcc1821356e17785094fd57f2c1deae1c44cd9c6c17cb5440871373fc808053dc2c8865a1c13410ecfb768de1cb
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYJCHyTtpPI/zjbGgX3iG9aofjjMnZxRwgBDZ0x:8uuSpTgyf2RnQ/3bZXSG9a+QxRzd0x
  • TLSH
    T1C3231B003BE9C12AF2BE4F78A8F26145867AF5673603D54A1CC441DB5623BC69A42AFD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2