Extracted

• • Target
    445eaa8ef332ffcf213681413ce9ed74caf70b3c642c93c169973dc759da8a62
  • Size 45KB
  • SHA256 445eaa8ef332ffcf213681413ce9ed74caf70b3c642c93c169973dc759da8a62
  • MD5 f72cfa98753fe11e77f92cf69bd0c2f4
  • SHA1 9fbcad0ef8f88d6904757eec8ee97217ba302593
  • SHA512 5743870c2ef99b0c4ee2fe297cc529e3aa5d033d60de5f6c13be72628378f1ac3951694728a39b4298d353ffabdfe6b7a064f73a1b5d6be23106c6eb5615c814
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFD3xK6yZoOPItzjbmg53i4NEkWPcj2DK364BDZUx:cu7e5TH2A22cPo3t3b55SsfW0iDKfdUx
  • TLSH
    T115233A003BED812BF2BE4F789DF26145467AF6A37503D5492CC4529B4613FC68A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2