Extracted

• • Target
    d233e4fb09489039e262e35de9dd0edbb2a025c390dcd78c26b856d7df51d374
  • Size 45KB
  • SHA256 d233e4fb09489039e262e35de9dd0edbb2a025c390dcd78c26b856d7df51d374
  • MD5 05a0ea4b4d332b5e6db458dbb26e32b9
  • SHA1 0193a2d361dd05a31c839c0d693b85c76343eb30
  • SHA512 d5a84870bf44f884c8e7f3e1bfae442c67f1265eafed18222f486ecd71473cbb398fe159946151bf497990262fe55a5ede569ca6077f9da31ae7737c704fabfb
  • SSDEEP 768:cuR0JTPUYkEWUmjWymo2q1f0eUNEARViZPI6zjbAgH3i1eWix3xMrufG1R+aBDZW:cuR0JTPjY2mUe+iW63bnHS1cMmG1R+E0
  • TLSH
    T152231A003BE8812BF2BE4F78A9F26141467AF6632603D58D1CC451DB5613FC6DA52AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2