Extracted

• • Target
    dd5b0de7510d4ad47d717ccc666be3bb9c23f5e7ceccad3cdfe3e8608135883a
  • Size 45KB
  • SHA256 dd5b0de7510d4ad47d717ccc666be3bb9c23f5e7ceccad3cdfe3e8608135883a
  • MD5 7b47dccf5788ba2e70d31ee2c374f1b4
  • SHA1 d8fa41d9c6c6d6ed07d68589325407f15567c311
  • SHA512 268b773051223af24369ce54a240a0e75c53e833c7ac643896f8c337084a18c0f0af2de8bc35e505f45b41dadb356d2d075566c9db1c43b336c57993e5d6e41a
  • SSDEEP 768:0u1YJTHwAUgQWUaT2Wmo2q9ZRz3wnOPIBzjbWgX3iWVKB/gofzJXBDZ8x:0u1YJTHcw2Sz+3B3bJXSFgofzJRd8x
  • TLSH
    T188231A0037E8822BF1BE4F78ADF25245867EF6673603D6491CC451DB5A13FC68A426FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2