Extracted

• • Target
    23b1c1e89caa2b3b77e76ae8df6a6bb429865d1fa7d4b3943974f8f291664d0d
  • Size 45KB
  • SHA256 23b1c1e89caa2b3b77e76ae8df6a6bb429865d1fa7d4b3943974f8f291664d0d
  • MD5 237fd8149ee5f3bd87f31b98b7e83c42
  • SHA1 37396c4ed95f7bdf2582a531a38496529f0ff013
  • SHA512 ea4f9ba1314fc0234e64d36781d52938a53e99392c32ed921e9e2fef94d1e9e3ca96e1a40527f0c9bd1d8893c3bb5d7ad4f8fb3075b3ce4427f3aeada193a230
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qNC9YikqHztOPIUzjbAgX3io8OQUwGcD1g8xlDi4BU:5uSy6pTpoo2valK3U3bnXSohwGC1gkJU
  • TLSH
    T1B42319003BE9822BF2BE5F789DF26145867AF1633603D6491CC451DB5713BC28A42AFE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2