Extracted

• • Target
    dcd751ed29f0d32b1109615cae5f2f13563be4459a3fec76a666ee79914f1fd7
  • Size 45KB
  • SHA256 dcd751ed29f0d32b1109615cae5f2f13563be4459a3fec76a666ee79914f1fd7
  • MD5 5c4fe6f74f7e18b2a8c042ce9c7fec27
  • SHA1 60f68f5ab0e82cd8996cfc1231e55ec4a05eadab
  • SHA512 7f67460b0a16740a4b2c0f27d61bb1ddb3feece646082adecdd918e43ec4c233ed0839adf5c930f7b2a98fbb237ecf521d9b623592a35f5ee9405d5a30581277
  • SSDEEP 768:cu7m/5THrq+CWUoDuMmo2qFV7lt440WMOPI0szjbvgXWi6+12Fk6Zj2gR297L4x4:cu7e5TH2A2QgUM30s3bYXfV12yy6gR2/
  • TLSH
    T1FC232A003BE8C12BF2BE5F7899F26145467AF6632603D64E1CC452DB5713BC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2