Extracted

• • Target
    dcdb95f8583ab3377d5675c8357e2e038a5469334b368d8f570a0e2769ee111b
  • Size 45KB
  • SHA256 dcdb95f8583ab3377d5675c8357e2e038a5469334b368d8f570a0e2769ee111b
  • MD5 33d9be4d9522d100500a0b11712a6a9c
  • SHA1 2f2dddf9144fc3bb1329c54281757d2b7b42332e
  • SHA512 02d1a7bf9f08080e815d2f0e1e93815f9e5c3eace61ce50cc2ae9a677981cfdf41035d9c9428c6b7d27a3058483e6a5aae322a52d53d1f1f761316d5da8d8a3a
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNi9YSkqXzNOPISzjbgg/3iEA6hQk219EBDZ0x:5uSy6pTpoo2PaVq3S3bH/Sx6Ck2id0x
  • TLSH
    T198233A003BE9822BF2BE4FB499F26145467AF5673603D64A1CC451DB5723FC28A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2