Extracted

• • Target
    021281d5c3d2b928dd654657581860fe3a783029ea8194be05553a45ef697adb
  • Size 45KB
  • SHA256 021281d5c3d2b928dd654657581860fe3a783029ea8194be05553a45ef697adb
  • MD5 ba483a18f55511ecd0f2abac6149ddd4
  • SHA1 2ecf02ca5a01449eb9550e995d64349fa6644a0a
  • SHA512 343ea4725bfa752d912fec4072e6471a9af572c9f506c9f3d6378a173da12a11e7b9245f56516c6fe218ef6f4b289c283889e09c9c4a04d78e2bd48dd4f0fc77
  • SSDEEP 768:suJdpTP3tcsWUODmqmo2qV+xJdxrPHuPIbzjbygT3iN1D/LJtBDZkx:suJdpTPdI27xR3b3b1TSN5Fjdkx
  • TLSH
    T16E231A003BE88227F2BE4F78A9F26145867AF5632603D64D2CC451DB5723FC68A526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2