Extracted

• • Target
    d215bd9e36aff71256d3363df20ce0ca42b56cea0c7b03e477bde19b65122360
  • Size 45KB
  • SHA256 d215bd9e36aff71256d3363df20ce0ca42b56cea0c7b03e477bde19b65122360
  • MD5 a32afbd1d89b60e062f35ba4fcb845ed
  • SHA1 d56889c5946934a191ff30ba87666eae414df357
  • SHA512 f81d1c8ccfda2c52473d5768c060e57ac0a96e1660f51dc3525ff5b84a26184456456929c2fe19c1fa5cac09e67fef22ff894c281127b8b6c5457d8d6d27c23e
  • SSDEEP 768:8uuSpTg7GBoWUSH6+mo2qYZ/NYssPJZOPIczzjb1gXci1NMQJtdfhNFojBDZ0x:8uuSpTgyf2hHIf3cz3bSXZHMQxhCd0x
  • TLSH
    T122232B0037D8C22BF1BE4F7898F26145867AB6633A03D68E1CC4519B5613FC6DA526FD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2