Extracted

• • Target
    0c083017eff808754086b4ff3cbbe48c195a7f84f2effe58841c9da5f0256e20
  • Size 45KB
  • SHA256 0c083017eff808754086b4ff3cbbe48c195a7f84f2effe58841c9da5f0256e20
  • MD5 d4c30b44e41c1e4bbbb2bba7059e86a9
  • SHA1 46d5afe7851fab52b2072bb31170b6f79db27519
  • SHA512 69963ddbca5a72fb356c9aaddfcdb74493d20d1e8329f8e9062e16fdbeb9406f05bdcc5e0407ba6d9d2784efede72a525a8d91e21b2529317e69d882444b0ef1
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNKiacyPzlOPIpzjbegB3iS4vVo0QVZrOBDZ0x:5uSy6pTpoo2HiVC3p3bhBStO0Qnkd0x
  • TLSH
    T142233B003BE9812BF2BF5F78A9F26145857AF1632603D64E1CC411DB1723BC69A526FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2