Extracted

• • Target
    0c407632f4da621b4ea1216d2feb14884810116ba9a2f1b8727c0d45a127ca8b
  • Size 45KB
  • SHA256 0c407632f4da621b4ea1216d2feb14884810116ba9a2f1b8727c0d45a127ca8b
  • MD5 c3601370a5cf265549e3df01b41e365b
  • SHA1 6f8c2b6fc6fb9e86e4baa24d42c39df3ea3843eb
  • SHA512 84a783e54e32c2cf474fd2a88da37b3660b00682c24160a2d49ffc8c82529cb4b2a8042e4b2cc93efb3de38bbe3c450dd966a903a29c17f1065a8433fe3bc293
  • SSDEEP 768:5udApTNctooWUS7C+mo2qtXCXtTtSPIBzjb1gX3iX17DWL7WStuml7BDZ0x:5udApTNmU2gwxB3bSXSXBSr/d0x
  • TLSH
    T154231B0037E8822BF2BE4F7899F26245867AF5673603D5892CC441DB5723FC696426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2